fix: cap stdin read at 1 MiB to prevent DoS

[Quratulain-bilal]

Unbounded sys.stdin.read() allowed a malicious caller to exhaust memory by sending a multi-gigabyte payload. Cap at 1 MiB and raise typer.Exit if truncated.

[Copilot]

Pull request overview

Caps stdin payloads for event commands to mitigate memory-exhaustion attacks.

Changes:

• Adds a nominal 1 MiB stdin limit.
• Rejects oversized payloads.

Show a summary per file

File	Description
src/specify_cli/commands/event.py	Adds bounded stdin handling.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 2
• Review effort level: Balanced

[Copilot]

Review details

Suppressed comments (3)

src/specify_cli/commands/event.py:30

• The normal native-hook path bypasses this cap: integrations invoke the generated .specify/events.py, whose template still performs an unbounded sys.stdin.read() at src/specify_cli/events.py:300. As a result, the DoS remains reachable through the event hooks this feature installs. Apply the bounded read to the dispatcher template as well (ideally via shared logic) so both entry points enforce the limit.

        raw = sys.stdin.read(MAX_STDIN_BYTES)

src/specify_cli/commands/event.py:35

• This branch cannot work with standard stdin streams: TextIOBase has no eof attribute, so every piped payload raises AttributeError; additionally, typer.Exit accepts an exit code but no message argument. Read one sentinel byte, compare its length, emit the message separately to stderr, and then exit.

        if not sys.stdin.eof:
            raise typer.Exit(
                code=1,
                message="stdin payload exceeds 1 MiB limit; "
                "truncate or pipe a smaller payload",

src/specify_cli/commands/event.py:29

• There are no command-level tests for this new input boundary, which allowed both invalid APIs in the overflow path to go unnoticed. Add cases for payloads below, exactly at, and one byte above the limit, asserting forwarding versus a clean exit with the expected stderr message.

    if not sys.stdin.isatty():

• Files reviewed: 1/1 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[mnriem]

Thank you!