From dde11b15de1db1b7695794abef4d190e4de60da1 Mon Sep 17 00:00:00 2001
From: grunfink <grunfink@comam.es>
Date: Wed, 2 Sep 2026 09:56:42 +0200
Subject: In activitypub_post_handler(), drop input messages that are too big.

---
 activitypub.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/activitypub.c b/activitypub.c
index 5c93bec..c148812 100644
--- a/activitypub.c
+++ b/activitypub.c
@@ -4110,6 +4110,12 @@ int activitypub_post_handler(const xs_dict *req, const char *q_path,
         xs_str_in(i_ctype, "application/ld+json") == -1)
         return 0;
 
+    if (p_size >= 100000) {
+        *body  = xs_str_new("too big");
+        *ctype = "text/plain";
+        return HTTP_STATUS_BAD_REQUEST;
+    }
+
     /* decode the message */
     xs *msg = xs_json_loads(payload);
     const char *id = xs_dict_get(msg, "id");
-- 
cgit