feat(core): Keep the tunnel body size checks with the streamed forward

#25515's 411 and 413 checks run before the header line is read, so an oversized or unlengthed request is
rejected without reading its body.

Author: logaretm

packages/core/src/utils/tunnel.ts

@@ -33,6 +33,11 @@ function getServedTunnel(): ServedTunnel | undefined {
   return client && servedTunnels.get(client);
 }
 
+/**
+ * Bounds what one tunnel request may send. SDK envelopes stay far below it.
+ */
+export const MAX_TUNNEL_BODY_SIZE = 20 * 1024 * 1024;
+
 export interface HandleTunnelRequestOptions {
   /** Incoming request containing the Sentry envelope as its body */
   request: Request;
@@ -215,6 +220,15 @@ async function forwardEnvelope(request: Request, allowedDsns: Array<string>): Pr
     return new Response('Tunnel not configured', { status: 500 });
   }
 
+  // The HTTP server ends the body at `Content-Length`, so the header bounds what the forward streams.
+  const contentLength = Number(request.headers.get('content-length'));
+  if (!contentLength) {
+    return new Response('Length required', { status: 411 });
+  }
+  if (contentLength > MAX_TUNNEL_BODY_SIZE) {
+    return new Response('Envelope too large', { status: 413 });
+  }
+
   const reader = request.body?.getReader();
   // A client aborting mid-upload makes the read throw.
   const head = reader && (await readEnvelopeHeaderLine(reader).catch(() => undefined));

packages/core/test/lib/utils/tunnel.test.ts

@@ -16,6 +16,7 @@ import {
   resolveAllowedDsns,
   resolveServerTunnelOption,
   resolveTunnelPaths,
+  MAX_TUNNEL_BODY_SIZE,
 } from '../../../src/utils/tunnel';
 import {
   _INTERNAL_resetManagedTunnelDefaults,
@@ -39,11 +40,15 @@ function getTunnelIgnoreSpanFilter(
   return getTunnelIgnoreSpanFilters(tunnelOptions, paths)[0];
 }
 
-function makeEnvelopeRequest(envelopeHeader: Record<string, unknown>, url = 'http://localhost/tunnel'): Request {
-  const envelope = createEnvelope(envelopeHeader, []);
-  const body = serializeEnvelope(envelope);
+function makeEnvelopeRequest(
+  envelopeHeader: Record<string, unknown>,
+  url = 'http://localhost/tunnel',
+  contentLength?: number,
+): Request {
+  const body = serializeEnvelope(createEnvelope(envelopeHeader, []));
+  const length = contentLength ?? new TextEncoder().encode(body as string).length;
 
-  return new Request(url, { method: 'POST', body });
+  return new Request(url, { method: 'POST', body, headers: { 'content-length': String(length) } });
 }
 
 /**
@@ -56,6 +61,7 @@ function makeEndlessRequest(head: string, onCancel?: () => void): Request {
   return new Request('http://localhost/tunnel', {
     method: 'POST',
     duplex: 'half',
+    headers: { 'content-length': String(MAX_TUNNEL_BODY_SIZE) },
     body: new ReadableStream<Uint8Array>({
       pull(controller) {
         controller.enqueue(sentHead ? filler : new TextEncoder().encode(head));
@@ -74,6 +80,40 @@ describe('handleTunnelRequest', () => {
     vi.stubGlobal('fetch', fetchMock);
   });
 
+  it('forwards the envelope when Content-Length equals the limit', async () => {
+    fetchMock.mockResolvedValueOnce(new Response('ok'));
+
+    const result = await handleTunnelRequest({
+      request: makeEnvelopeRequest({ dsn: TEST_DSN }, undefined, MAX_TUNNEL_BODY_SIZE),
+      allowedDsns: [TEST_DSN],
+    });
+
+    expect(result.status).toBe(200);
+  });
+
+  it('returns 413 when Content-Length is above the limit, without reading the body', async () => {
+    const request = makeEnvelopeRequest({ dsn: TEST_DSN }, undefined, MAX_TUNNEL_BODY_SIZE + 1);
+
+    const result = await handleTunnelRequest({ request, allowedDsns: [TEST_DSN] });
+
+    expect(result.status).toBe(413);
+    expect(request.bodyUsed).toBe(false);
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it('returns 411 when the request has no Content-Length', async () => {
+    const result = await handleTunnelRequest({
+      request: new Request('http://localhost/tunnel', {
+        method: 'POST',
+        body: `${JSON.stringify({ dsn: TEST_DSN })}\n`,
+      }),
+      allowedDsns: [TEST_DSN],
+    });
+
+    expect(result.status).toBe(411);
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
   afterEach(() => {
     vi.restoreAllMocks();
     getCurrentScope().setClient(undefined);
@@ -132,7 +172,7 @@ describe('handleTunnelRequest', () => {
       request: new Request('http://localhost/tunnel', {
         method: 'POST',
         body: `${JSON.stringify({ dsn: TEST_DSN })}\n`,
-        headers: incomingHeaders,
+        headers: { ...incomingHeaders, 'content-length': '1' },
       }),
       allowedDsns: [TEST_DSN],
     });