ethstats: set readlimit on ethstats server connection (#26207)

This prevents DoS when connected to a malicious ethstats server.
bendanzhentan · Nov 17, 2022 · c2e0abc · c2e0abc
1 parent 97c563e
commit c2e0abc
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/ethstats/ethstats.go b/ethstats/ethstats.go
@@ -57,6 +57,8 @@ const (
 	txChanSize = 4096
 	// chainHeadChanSize is the size of channel listening to ChainHeadEvent.
 	chainHeadChanSize = 10
+
+	messageSizeLimit = 15 * 1024 * 1024
 )
 
 // backend encompasses the bare-minimum functionality needed for ethstats reporting
@@ -121,6 +123,7 @@ type connWrapper struct {
 }
 
 func newConnectionWrapper(conn *websocket.Conn) *connWrapper {
+	conn.SetReadLimit(messageSizeLimit)
 	return &connWrapper{conn: conn}
 }