Security: limit memory consumption in receiveBody

lib/network.js

@@ -1,9 +1,21 @@
 'use strict';
 
-const receiveBody = async (stream) => {
+const MAX_BODY_SIZE = 10 * 1024 * 1024;
+
+const receiveBody = async (stream, limit = MAX_BODY_SIZE) => {
+  if (!Number.isSafeInteger(limit) || limit < 0) {
+    throw new TypeError('Body size limit must be a non-negative safe integer');
+  }
   const chunks = [];
-  for await (const chunk of stream) chunks.push(chunk);
-  return Buffer.concat(chunks);
+  let size = 0;
+  for await (const chunk of stream) {
+    size += chunk.length;
+    if (size > limit) {
+      throw new Error('Body size limit exceeded');
+    }
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks, size);
 };
 
 const IPV4_OCTETS = 4;
@@ -50,4 +62,4 @@
   ipToInt,
   intToIp,
   httpApiCall,
-};
+};