Merge pull request #4039 from kevin-wangzefeng/cherry-pick-GHSA-vwm6-qc77-v2rh-v1.10v1.10.2

Cherry-pick GHSA-vwm6-qc77-v2rh: fix invalid request

11 files changed, 23 insertions, 11 deletions

diff --git a/cloud/pkg/admissioncontroller/common.go b/cloud/pkg/admissioncontroller/common.go
index 57c35fed6..97a870be2 100644
--- a/cloud/pkg/admissioncontroller/common.go
+++ b/cloud/pkg/admissioncontroller/common.go
@@ -12,6 +12,8 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	admissionregistrationv1beta1client "k8s.io/client-go/kubernetes/typed/admissionregistration/v1beta1"
 	"k8s.io/klog/v2"
+
+	"github.com/kubeedge/kubeedge/common/constants"
 )
 
 func registerValidateWebhook(client admissionregistrationv1beta1client.ValidatingWebhookConfigurationInterface,
@@ -66,6 +68,7 @@ type hookFunc func(admissionv1beta1.AdmissionReview) *admissionv1beta1.Admission
 func serve(w http.ResponseWriter, r *http.Request, hook hookFunc) {
 	var body []byte
 	if r.Body != nil {
+		r.Body = http.MaxBytesReader(w, r.Body, constants.MaxRespBodyLength)
 		if data, err := io.ReadAll(r.Body); err == nil {
 			body = data
 		}
diff --git a/cloud/pkg/cloudhub/servers/httpserver/server.go b/cloud/pkg/cloudhub/servers/httpserver/server.go
index fa5377911..abeee939d 100644
--- a/cloud/pkg/cloudhub/servers/httpserver/server.go
+++ b/cloud/pkg/cloudhub/servers/httpserver/server.go
@@ -173,6 +173,7 @@ func verifyAuthorization(w http.ResponseWriter, r *http.Request) bool {
 
 // signEdgeCert signs the CSR from EdgeCore
 func signEdgeCert(w http.ResponseWriter, r *http.Request) {
+	r.Body = http.MaxBytesReader(w, r.Body, constants.MaxRespBodyLength)
 	csrContent, err := io.ReadAll(r.Body)
 	if err != nil {
 		klog.Errorf("fail to read file when signing the cert for edgenode:%s! error:%v", r.Header.Get(constants.NodeName), err)
diff --git a/cloud/pkg/router/listener/http.go b/cloud/pkg/router/listener/http.go
index fd88b936c..8c7b6c135 100644
--- a/cloud/pkg/router/listener/http.go
+++ b/cloud/pkg/router/listener/http.go
@@ -157,7 +157,7 @@ func (rh *RestHandler) httpHandler(w http.ResponseWriter, r *http.Request) {
 			klog.Errorf("response convert error, msg id: %s, reason: %v", msgID, err)
 			return
 		}
-		body, err := io.ReadAll(response.Body)
+		body, err := io.ReadAll(io.LimitReader(response.Body, MaxMessageBytes))
 		if err != nil {
 			klog.Errorf("response body read error, msg id: %s, reason: %v", msgID, err)
 			return
diff --git a/cloud/pkg/router/provider/servicebus/servicebus.go b/cloud/pkg/router/provider/servicebus/servicebus.go
index cb85aa255..9afb6074c 100644
--- a/cloud/pkg/router/provider/servicebus/servicebus.go
+++ b/cloud/pkg/router/provider/servicebus/servicebus.go
@@ -17,6 +17,7 @@ import (
 	"github.com/kubeedge/kubeedge/cloud/pkg/router/constants"
 	"github.com/kubeedge/kubeedge/cloud/pkg/router/listener"
 	"github.com/kubeedge/kubeedge/cloud/pkg/router/provider"
+	commonconstants "github.com/kubeedge/kubeedge/common/constants"
 	commonType "github.com/kubeedge/kubeedge/common/types"
 )
 
@@ -99,7 +100,7 @@ func (sb *ServiceBus) Forward(target provider.Target, data interface{}) (respons
 	klog.Infof("message is send to target successfully. msgID: %s, target: %s", message.GetID(), target.Name())
 	httpResp, ok := resp.(*http.Response)
 	if ok {
-		byteData, _ := io.ReadAll(httpResp.Body)
+		byteData, _ := io.ReadAll(io.LimitReader(httpResp.Body, commonconstants.MaxRespBodyLength))
 		beehiveContext.SendToGroup(modules.CloudHubModuleGroup, *message.NewRespByMessage(message, string(byteData)))
 	}
 	return resp, nil
diff --git a/common/constants/default.go b/common/constants/default.go
index d3917be71..a99879638 100644
--- a/common/constants/default.go
+++ b/common/constants/default.go
@@ -146,4 +146,7 @@ const (
 
 	// MessageSuccessfulContent is the successful content value of Message struct
 	MessageSuccessfulContent string = "OK"
+
+	// MaxRespBodyLength is the max length of http response body
+	MaxRespBodyLength = 1 << 20 // 1 MiB
 )
diff --git a/edge/pkg/edgehub/certificate/certmanager.go b/edge/pkg/edgehub/certificate/certmanager.go
index 4bc727f8b..d912a5242 100644
--- a/edge/pkg/edgehub/certificate/certmanager.go
+++ b/edge/pkg/edgehub/certificate/certmanager.go
@@ -254,8 +254,7 @@ func GetCACert(url string) ([]byte, error) {
 		return nil, err
 	}
 	defer res.Body.Close()
-
-	caCert, err := io.ReadAll(res.Body)
+	caCert, err := io.ReadAll(io.LimitReader(res.Body, constants.MaxRespBodyLength))
 	if err != nil {
 		return nil, err
 	}
@@ -286,7 +285,7 @@ func (cm *CertManager) GetEdgeCert(url string, capem []byte, cert tls.Certificat
 	}
 	defer res.Body.Close()
 
-	content, err := io.ReadAll(res.Body)
+	content, err := io.ReadAll(io.LimitReader(res.Body, constants.MaxRespBodyLength))
 	if err != nil {
 		return nil, nil, err
 	}
diff --git a/edge/pkg/servicebus/servicebus.go b/edge/pkg/servicebus/servicebus.go
index c89a6b051..132ed97a2 100644
--- a/edge/pkg/servicebus/servicebus.go
+++ b/edge/pkg/servicebus/servicebus.go
@@ -180,8 +180,7 @@ func processMessage(msg *beehiveModel.Message) {
 			return
 		}
 		defer resp.Body.Close()
-		resp.Body = http.MaxBytesReader(nil, resp.Body, maxBodySize)
-		resBody, err := io.ReadAll(resp.Body)
+		resBody, err := io.ReadAll(io.LimitReader(resp.Body, maxBodySize))
 		if err != nil {
 			if err.Error() == "http: request body too large" {
 				err = fmt.Errorf("response body too large")
@@ -236,6 +235,7 @@ func buildBasicHandler(timeout time.Duration) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
 		sReq := &serverRequest{}
 		sResp := &serverResponse{}
+		req.Body = http.MaxBytesReader(w, req.Body, maxBodySize)
 		byteData, err := io.ReadAll(req.Body)
 		if err != nil {
 			sResp.Code = http.StatusBadRequest
diff --git a/keadm/cmd/keadm/app/cmd/util/common.go b/keadm/cmd/keadm/app/cmd/util/common.go
index 5ccf9835a..13956481a 100644
--- a/keadm/cmd/keadm/app/cmd/util/common.go
+++ b/keadm/cmd/keadm/app/cmd/util/common.go
@@ -199,8 +199,7 @@ func GetLatestVersion() (string, error) {
 	if resp.StatusCode != http.StatusOK {
 		return "", fmt.Errorf("failed to get latest version from %s, expected %d, got status code: %d", latestReleaseVersionURL, http.StatusOK, resp.StatusCode)
 	}
-
-	body, err := io.ReadAll(resp.Body)
+	body, err := io.ReadAll(io.LimitReader(resp.Body, constants.MaxRespBodyLength))
 	if err != nil {
 		return "", err
 	}
diff --git a/pkg/stream/message.go b/pkg/stream/message.go
index fbaae6ce4..18df19a60 100644
--- a/pkg/stream/message.go
+++ b/pkg/stream/message.go
@@ -23,6 +23,8 @@ import (
 	"io"
 
 	"k8s.io/klog/v2"
+
+	"github.com/kubeedge/kubeedge/common/constants"
 )
 
 type MessageType uint64
@@ -89,7 +91,7 @@ func ReadMessageFromTunnel(r io.Reader) (*Message, error) {
 	if err != nil {
 		return nil, err
 	}
-	data, err := io.ReadAll(buf)
+	data, err := io.ReadAll(io.LimitReader(buf, constants.MaxRespBodyLength))
 	if err != nil {
 		return nil, err
 	}
diff --git a/staging/src/github.com/kubeedge/viaduct/pkg/client/ws.go b/staging/src/github.com/kubeedge/viaduct/pkg/client/ws.go
index 5485888dc..2991771d4 100644
--- a/staging/src/github.com/kubeedge/viaduct/pkg/client/ws.go
+++ b/staging/src/github.com/kubeedge/viaduct/pkg/client/ws.go
@@ -8,6 +8,7 @@ import (
 	"k8s.io/klog/v2"
 
 	"github.com/kubeedge/viaduct/pkg/api"
+	"github.com/kubeedge/viaduct/pkg/comm"
 	"github.com/kubeedge/viaduct/pkg/conn"
 	"github.com/kubeedge/viaduct/pkg/lane"
 )
@@ -66,7 +67,7 @@ func (c *WSClient) Connect() (conn.Connection, error) {
 	// something wrong!!
 	var respMsg string
 	if resp != nil {
-		body, errRead := io.ReadAll(resp.Body)
+		body, errRead := io.ReadAll(io.LimitReader(resp.Body, comm.MaxReadLength))
 		if errRead == nil {
 			respMsg = fmt.Sprintf("response code: %d, response body: %s", resp.StatusCode, string(body))
 		} else {
diff --git a/staging/src/github.com/kubeedge/viaduct/pkg/comm/comm.go b/staging/src/github.com/kubeedge/viaduct/pkg/comm/comm.go
index 66c7b757c..aced5776f 100644
--- a/staging/src/github.com/kubeedge/viaduct/pkg/comm/comm.go
+++ b/staging/src/github.com/kubeedge/viaduct/pkg/comm/comm.go
@@ -19,4 +19,7 @@ const (
 
 	// the max size of message fifo
 	MessageFiFoSizeMax = 100
+
+	// MaxReadLength is the max length of http response body
+	MaxReadLength = 1 << 20 // 1 MiB
 )