Reject a request body over the configured size before parsing it

Author: thomas-samoht

app.conf.example

@@ -1,6 +1,8 @@
 [app]
 # Loglevel can be one of: debug, info, warning, error, critical
 loglevel=debug
+# Maximum size of a request body in bytes, larger requests are rejected before they are parsed
+max_request_body_bytes = 1048576
 
 [logging]
 # All keys are optional. When syslog_path is omitted, logs only go to stdout.

app/application.py

@@ -23,6 +23,7 @@
 from app.logging.context import CLAIM_FIELDS
 from app.logging.events import Log
 from app.models.fhir.resources.localization_list.request import COUNT_PARAM
+from app.request_body_limit import RequestBodyLimitMiddleware
 from app.routers.default import router as default_router
 from app.routers.fhir.base import router as fhir_base_router
 from app.routers.fhir.localization_list import router as fhir_list_router
@@ -199,6 +200,7 @@ def setup_fastapi() -> FastAPI:
     register_exceptions(fastapi)
     _document_page_sizes(fastapi, config.pagination.default_page_size, config.pagination.max_page_size)
 
+    fastapi.add_middleware(RequestBodyLimitMiddleware, max_bytes=config.app.max_request_body_bytes)
     fastapi.add_middleware(
         RequestContextMiddleware,
         correlation_id_expected=config.logging.correlation_id_expected,

app/config.py

@@ -28,6 +28,7 @@ class LogLevel(str, Enum):
 
 class ConfigApp(BaseModel):
     loglevel: LogLevel = Field(default=LogLevel.info)
+    max_request_body_bytes: int = Field(default=1048576, ge=1)
 
 
 class ConfigDatabase(BaseModel):

app/errors/mapping.py

@@ -3,6 +3,7 @@
 from pydantic import BaseModel, ConfigDict
 
 from app.models.fhir.resources.operation_outcome.resource import IssueType
+from app.request_body_limit import RequestBodyTooLargeError
 from app.services.exceptions import (
     BundleTooLargeError,
     ConflictError,
@@ -45,6 +46,9 @@ class ErrorSpec(BaseModel):
     PseudonymExchangeError: ErrorSpec(severity="error", fhir_code="invalid", http_status=400, log_as="failure"),
     CryptoServiceError: ErrorSpec(severity="error", fhir_code="transient", http_status=502, log_as="failure"),
     BundleTooLargeError: ErrorSpec(severity="error", fhir_code="too-costly", http_status=413, log_as="invalid_request"),
+    RequestBodyTooLargeError: ErrorSpec(
+        severity="error", fhir_code="too-long", http_status=413, log_as="invalid_request"
+    ),
 }
 
 # Applied to any exception without a mapped type (rendered as HTTP 500). Unmapped

app/request_body_limit.py

@@ -0,0 +1,33 @@
+from starlette.exceptions import HTTPException
+from starlette.types import ASGIApp, Message, Receive, Scope, Send
+
+
+class RequestBodyTooLargeError(HTTPException):
+    def __init__(self, max_bytes: int) -> None:
+        super().__init__(status_code=413, detail=f"Request body exceeds the maximum of {max_bytes} bytes")
+
+    def __str__(self) -> str:
+        return self.detail
+
+
+class RequestBodyLimitMiddleware:
+    def __init__(self, app: ASGIApp, max_bytes: int) -> None:
+        self.app = app
+        self.max_bytes = max_bytes
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        if scope["type"] != "http":
+            await self.app(scope, receive, send)
+            return
+
+        received = 0
+
+        async def limited_receive() -> Message:
+            nonlocal received
+            message = await receive()
+            received += len(message.get("body", b""))
+            if received > self.max_bytes:
+                raise RequestBodyTooLargeError(self.max_bytes)
+            return message
+
+        await self.app(scope, limited_receive, send)

tests/errors/test_mapping.py

@@ -3,6 +3,7 @@
 from app.errors.mapping import DEFAULT_SPEC, ErrorSpec, LogAs, should_log_failure, spec_for
 from app.models.auth.data import AuthorizationScope
 from app.models.fhir.resources.operation_outcome.resource import IssueType
+from app.request_body_limit import RequestBodyTooLargeError
 from app.services.exceptions import (
     BundleTooLargeError,
     ConflictError,
@@ -45,6 +46,9 @@ def _scope_error() -> UnauthorizedScopeError:
         pytest.param(
             BundleTooLargeError("too many"), _spec("too-costly", 413, "invalid_request"), id="bundle-too-large"
         ),
+        pytest.param(
+            RequestBodyTooLargeError(10), _spec("too-long", 413, "invalid_request"), id="request-body-too-large"
+        ),
         pytest.param(InvalidModelError("bad"), _spec("structure", 400, "invalid_request"), id="invalid-model"),
         pytest.param(_scope_error(), _spec("security", 403), id="unauthorized-scope-via-mro"),
         pytest.param(UnauthorizedManagingRequestError(), _spec("security", 403), id="unauthorized-managing-via-mro"),

tests/routers/test_fhir_base.py

@@ -58,6 +58,17 @@ def test_rejects_a_bundle_over_the_entry_limit_without_processing_it(self, clien
         assert len(records.for_event(Log.INVALID_REQUEST)) == 1
         assert records.for_event(Log.REGISTERED_REFERRAL) == []
 
+    @pytest.mark.parametrize("chunked", [False, True], ids=["content-length", "chunked"])
+    def test_rejects_a_body_over_the_size_limit_before_parsing_it(self, client: TestClient, chunked: bool) -> None:
+        body = b"x" * (get_test_config().app.max_request_body_bytes + 1)
+        content = iter([body]) if chunked else body
+        with capture_records("app") as records:
+            response = client.post("/fhir", content=content, headers=FHIR_JSON)
+
+        assert response.status_code == 413
+        assert response.json()["issue"][0]["code"] == "too-long"
+        assert_event_emitted(records, Log.INVALID_REQUEST, http_status=413)
+
     def test_rejects_an_empty_bundle(self, client: TestClient) -> None:
         response = client.post("/fhir", json=_bundle(), headers=FHIR_JSON)
 

tests/test_config.py

@@ -76,3 +76,7 @@ def test_bundle_defaults_when_the_section_is_missing() -> None:
 def test_bundle_rejects_a_maximum_below_one() -> None:
     with pytest.raises(ValidationError):
         ConfigBundle(max_entries=0)
+
+
+def test_request_body_limit_defaults_to_one_mebibyte() -> None:
+    assert get_test_config().app.max_request_body_bytes == 1048576