feat(Bimex): security-indexer-l-mite-de-64kb-en-cuerpos-de-re

bimex-indexer/.env.example

@@ -8,6 +8,8 @@ START_LEDGER=0
 POLL_INTERVAL_MS=10000
 # Analytics API port
 API_PORT=3002
+# Max JSON request body size for POST /faucet (bytes, default 65536 = 64KB)
+MAX_BODY_BYTES=65536
 # Health check port
 HEALTH_PORT=3001
 # Allowed origins for CORS (comma-separated, no spaces).

bimex-indexer/api.js

@@ -153,12 +153,9 @@ function readBody(req, res) {
     const abort413 = () => {
       if (tooLarge) return;
       tooLarge = true;
-      // 'Connection: close' antes de escribir la respuesta: le avisa al
-      // cliente que no debe reusar este socket keep-alive, porque lo vamos
-      // a destruir para cortar la subida del resto del body sobredimensionado.
       res.setHeader('Connection', 'close');
       json(req, res, 413, { error: 'Cuerpo demasiado grande' });
-      res.once('finish', () => req.destroy());
+      req.destroy();
       reject(Object.assign(new Error('Cuerpo demasiado grande'), { statusCode: 413 }));
     };
 
@@ -535,4 +532,6 @@ const server = http.createServer(async (req, res) => {
 server.headersTimeout = 30_000;
 server.requestTimeout = 60_000;
 
+export { server, MAX_BODY_BYTES };
+
 server.listen(PORT, () => console.log(`Bimex API listening on port ${PORT}`));

bimex-indexer/tests/api.test.js

@@ -114,7 +114,7 @@ vi.mock('@stellar/stellar-sdk', () => {
 });
 
 // ─── Import the server (starts listening on port 3009) ─────────────────────
-import '../api.js';
+import { server as apiServer, MAX_BODY_BYTES } from '../api.js';
 import http from 'node:http';
 import mockSupabase from '../database.js';
 
@@ -384,4 +384,15 @@ describe('api.js REST Endpoints', () => {
       expect(res.body).toEqual({ exito: true, cantidad: 100 });
     });
   });
+
+  describe('HTTP server hardening', () => {
+    it('defaults MAX_BODY_BYTES to 64KiB', () => {
+      expect(MAX_BODY_BYTES).toBe(64 * 1024);
+    });
+
+    it('sets headersTimeout and requestTimeout against slowloris', () => {
+      expect(apiServer.headersTimeout).toBe(30_000);
+      expect(apiServer.requestTimeout).toBe(60_000);
+    });
+  });
 });