security(indexer): límite de 64KB en cuerpos de request + timeouts anti-slowloris

[David1984TK]

Descripción

Categoría: Ciberseguridad (hardening anti-DoS)

readBody acumulaba el cuerpo del request sin límite: un solo cliente podía agotar la memoria del indexer mandando un JSON gigante. Además el server HTTP no tenía timeouts explícitos contra conexiones que gotean bytes (slowloris).

Cambios

• bimex-indexer/api.js:
  • readBody ahora aborta con 413 al superar MAX_BODY_BYTES (64KB por defecto, configurable por env) y destruye la conexión.
  • server.headersTimeout = 30s y server.requestTimeout = 60s. No afectan a /sse: aplican a la recepción del request, no a la respuesta en streaming.

Verificación

• npx vitest run pasa sin errores (indexer: 38/38)
• npm run test:run frontend (no aplica, no se tocó)
• cargo test (no aplica, no se tocó el contrato)

Notas para el revisor

Los endpoints actuales usan payloads de <1KB, así que 64KB da margen de sobra. El endpoint de subida IPFS del PR #217 usa su propio lector con límite mayor (15MB), en un módulo separado — ambos PRs son independientes y compatibles.

[Joseph-1-Duro]

@Joseph-1-Duro has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hola, I would love to work on your project.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Joseph-1-Duro to this issue.

[Caneryy]

@Caneryy has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi, I'd like to work on this issue please.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Caneryy to this issue.

[drips-wave]

Congratulations, @Caneryy! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on July 30, 2026.

🧑‍💻 @Caneryy: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊