fix: harden VS Code bridge and webview CSP

cmd/vscode-bridge/main.go

@@ -47,6 +47,14 @@ type runtimeEventRequest struct {
 	Payload map[string]any `json:"payload"`
 }
 
+const (
+	bridgeReadHeaderTimeout = 5 * time.Second
+	bridgeReadTimeout       = 15 * time.Second
+	bridgeIdleTimeout       = 60 * time.Second
+	bridgeMaxHeaderBytes    = 16 << 10
+	bridgeMaxJSONBodyBytes  = 1 << 20
+)
+
 type eventBroker struct {
 	mu      sync.Mutex
 	clients map[chan []byte]struct{}
@@ -115,7 +123,7 @@ func main() {
 	mux.HandleFunc("/events", bridge.auth(token, bridge.handleEvents))
 	mux.HandleFunc("/runtime/event", bridge.auth(token, bridge.handleRuntimeEvent))
 
-	server := &http.Server{Handler: mux}
+	server := newBridgeHTTPServer(mux)
 	listener, err := net.Listen("tcp", *listenAddr)
 	if err != nil {
 		log.Fatalf("listen: %v", err)
@@ -207,7 +215,7 @@ func (a *bridgeApp) handleRPC(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	var req rpcRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+	if err := decodeLimitedJSON(w, r, &req); err != nil {
 		writeJSON(w, rpcResponse{Error: err.Error()})
 		return
 	}
@@ -225,7 +233,7 @@ func (a *bridgeApp) handleRuntimeEvent(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	var req runtimeEventRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+	if err := decodeLimitedJSON(w, r, &req); err != nil {
 		writeJSON(w, rpcResponse{Error: err.Error()})
 		return
 	}
@@ -325,6 +333,21 @@ func randomToken() (string, error) {
 	return hex.EncodeToString(b[:]), nil
 }
 
+func newBridgeHTTPServer(handler http.Handler) *http.Server {
+	return &http.Server{
+		Handler:           handler,
+		ReadHeaderTimeout: bridgeReadHeaderTimeout,
+		ReadTimeout:       bridgeReadTimeout,
+		IdleTimeout:       bridgeIdleTimeout,
+		MaxHeaderBytes:    bridgeMaxHeaderBytes,
+	}
+}
+
+func decodeLimitedJSON(w http.ResponseWriter, r *http.Request, dst any) error {
+	r.Body = http.MaxBytesReader(w, r.Body, bridgeMaxJSONBodyBytes)
+	return json.NewDecoder(r.Body).Decode(dst)
+}
+
 func writeJSON(w http.ResponseWriter, value any) {
 	w.Header().Set("Content-Type", "application/json")
 	_ = json.NewEncoder(w).Encode(value)

cmd/vscode-bridge/main_test.go

@@ -0,0 +1,66 @@
+package main
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestNewBridgeHTTPServerSetsResourceLimits(t *testing.T) {
+	server := newBridgeHTTPServer(http.NewServeMux())
+
+	if server.ReadHeaderTimeout != bridgeReadHeaderTimeout {
+		t.Fatalf("ReadHeaderTimeout = %s, want %s", server.ReadHeaderTimeout, bridgeReadHeaderTimeout)
+	}
+	if server.ReadTimeout != bridgeReadTimeout {
+		t.Fatalf("ReadTimeout = %s, want %s", server.ReadTimeout, bridgeReadTimeout)
+	}
+	if server.IdleTimeout != bridgeIdleTimeout {
+		t.Fatalf("IdleTimeout = %s, want %s", server.IdleTimeout, bridgeIdleTimeout)
+	}
+	if server.MaxHeaderBytes != bridgeMaxHeaderBytes {
+		t.Fatalf("MaxHeaderBytes = %d, want %d", server.MaxHeaderBytes, bridgeMaxHeaderBytes)
+	}
+}
+
+func TestHandleRPCRejectsOversizedJSONBody(t *testing.T) {
+	app := &bridgeApp{}
+	largeBody := `{"method":"ListProfiles","args":[],"pad":"` + strings.Repeat("x", bridgeMaxJSONBodyBytes) + `"}`
+	req := httptest.NewRequest(http.MethodPost, "/rpc", strings.NewReader(largeBody))
+	rec := httptest.NewRecorder()
+
+	app.handleRPC(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d", rec.Code, http.StatusOK)
+	}
+	var resp rpcResponse
+	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("response is not JSON: %v", err)
+	}
+	if !strings.Contains(resp.Error, "request body too large") {
+		t.Fatalf("error = %q, want request body limit error", resp.Error)
+	}
+}
+
+func TestHandleRuntimeEventRejectsOversizedJSONBody(t *testing.T) {
+	app := &bridgeApp{}
+	largeBody := `{"name":"session:secret:response","payload":{"pad":"` + strings.Repeat("x", bridgeMaxJSONBodyBytes) + `"}}`
+	req := httptest.NewRequest(http.MethodPost, "/runtime/event", strings.NewReader(largeBody))
+	rec := httptest.NewRecorder()
+
+	app.handleRuntimeEvent(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d", rec.Code, http.StatusOK)
+	}
+	var resp rpcResponse
+	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("response is not JSON: %v", err)
+	}
+	if !strings.Contains(resp.Error, "request body too large") {
+		t.Fatalf("error = %q, want request body limit error", resp.Error)
+	}
+}