diff --git a/apps/dokploy/__test__/deploy/github-webhook-handler.test.ts b/apps/dokploy/__test__/deploy/github-webhook-handler.test.ts index 43594848a..d11c9c736 100644 --- a/apps/dokploy/__test__/deploy/github-webhook-handler.test.ts +++ b/apps/dokploy/__test__/deploy/github-webhook-handler.test.ts @@ -62,6 +62,10 @@ vi.mock("@dokploy/server/db", () => ({ }, })); +vi.mock("next/dist/server/api-utils/node/parse-body", () => ({ + parseBody: async (req: { body: unknown }) => req.body, +})); + vi.mock("@dokploy/server", () => ({ DEPLOY_WEBHOOK_MAX_BODY_SIZE: 25 * 1024 * 1024, IS_CLOUD: false, diff --git a/apps/dokploy/pages/api/deploy/[refreshToken].ts b/apps/dokploy/pages/api/deploy/[refreshToken].ts index 5fa176bdf..03430ea08 100644 --- a/apps/dokploy/pages/api/deploy/[refreshToken].ts +++ b/apps/dokploy/pages/api/deploy/[refreshToken].ts @@ -8,6 +8,7 @@ import { import { db } from "@dokploy/server/db"; import { eq } from "drizzle-orm"; import type { NextApiRequest, NextApiResponse } from "next"; +import { parseBody } from "next/dist/server/api-utils/node/parse-body"; import { applications } from "@/server/db/schema"; import type { DeploymentJob } from "@/server/queues/queue-types"; import { myQueue } from "@/server/queues/queueSetup"; @@ -35,9 +36,7 @@ const getPackageVersion = (headers: any, body: any) => { export const config = { api: { - bodyParser: { - sizeLimit: DEPLOY_WEBHOOK_MAX_BODY_SIZE, - }, + bodyParser: false, }, }; @@ -45,6 +44,11 @@ export default async function handler( req: NextApiRequest, res: NextApiResponse, ) { + if (Number(req.headers["content-length"]) > DEPLOY_WEBHOOK_MAX_BODY_SIZE) { + res.status(413).json({ message: "Payload too large" }); + return; + } + req.body = await parseBody(req, DEPLOY_WEBHOOK_MAX_BODY_SIZE); const { refreshToken } = req.query; try { if (req.headers["x-github-event"] === "ping") { diff --git a/apps/dokploy/pages/api/deploy/compose/[refreshToken].ts b/apps/dokploy/pages/api/deploy/compose/[refreshToken].ts index f11f96c10..fc7d3c54e 100644 --- a/apps/dokploy/pages/api/deploy/compose/[refreshToken].ts +++ b/apps/dokploy/pages/api/deploy/compose/[refreshToken].ts @@ -6,6 +6,7 @@ import { import { db } from "@dokploy/server/db"; import { eq } from "drizzle-orm"; import type { NextApiRequest, NextApiResponse } from "next"; +import { parseBody } from "next/dist/server/api-utils/node/parse-body"; import { compose } from "@/server/db/schema"; import type { DeploymentJob } from "@/server/queues/queue-types"; import { myQueue } from "@/server/queues/queueSetup"; @@ -21,9 +22,7 @@ import { export const config = { api: { - bodyParser: { - sizeLimit: DEPLOY_WEBHOOK_MAX_BODY_SIZE, - }, + bodyParser: false, }, }; @@ -31,6 +30,11 @@ export default async function handler( req: NextApiRequest, res: NextApiResponse, ) { + if (Number(req.headers["content-length"]) > DEPLOY_WEBHOOK_MAX_BODY_SIZE) { + res.status(413).json({ message: "Payload too large" }); + return; + } + req.body = await parseBody(req, DEPLOY_WEBHOOK_MAX_BODY_SIZE); const { refreshToken } = req.query; try { if (req.headers["x-github-event"] === "ping") { diff --git a/apps/dokploy/pages/api/deploy/github.ts b/apps/dokploy/pages/api/deploy/github.ts index 713e93d79..55427c10f 100644 --- a/apps/dokploy/pages/api/deploy/github.ts +++ b/apps/dokploy/pages/api/deploy/github.ts @@ -14,6 +14,7 @@ import { db } from "@dokploy/server/db"; import { Webhooks } from "@octokit/webhooks"; import { and, eq } from "drizzle-orm"; import type { NextApiRequest, NextApiResponse } from "next"; +import { parseBody } from "next/dist/server/api-utils/node/parse-body"; import { applications, compose, github } from "@/server/db/schema"; import type { DeploymentJob } from "@/server/queues/queue-types"; import { myQueue } from "@/server/queues/queueSetup"; @@ -29,9 +30,7 @@ const getGithubRepositoryOwner = (githubBody: any) => export const config = { api: { - bodyParser: { - sizeLimit: DEPLOY_WEBHOOK_MAX_BODY_SIZE, - }, + bodyParser: false, }, }; @@ -39,6 +38,11 @@ export default async function handler( req: NextApiRequest, res: NextApiResponse, ) { + if (Number(req.headers["content-length"]) > DEPLOY_WEBHOOK_MAX_BODY_SIZE) { + res.status(413).json({ message: "Payload too large" }); + return; + } + req.body = await parseBody(req, DEPLOY_WEBHOOK_MAX_BODY_SIZE); const signature = req.headers["x-hub-signature-256"]; if (!signature) { res.status(401).json({ message: "Missing signature header" });