Security: limit memory consumption in receiveBody

lib/network.js

@@ -1,8 +1,17 @@
 'use strict';
 
-const receiveBody = async (stream) => {
+const MAX_BODY_SIZE = 0xffffffff;
+
+const receiveBody = async (stream, limit = MAX_BODY_SIZE) => {
   const chunks = [];
-  for await (const chunk of stream) chunks.push(chunk);
+  let size = 0;
+  for await (const chunk of stream) {
+    size += chunk.length;
+    if (size > limit) {
+      throw new Error('Body size limit exceeded');
+    }
+    chunks.push(chunk);
+  }
   return Buffer.concat(chunks);
 };