Extra checks body size

api/api.go

@@ -39,8 +39,12 @@ func CreateServer(
 	rateLimitTimeWindowInSeconds int,
 	isProfileModeActivated bool,
 	shouldStartSwaggerUI bool,
+	maxRequestBodySize int64,
 ) (*http.Server, error) {
 	ws := gin.Default()
+	if maxRequestBodySize > 0 {
+		ws.Use(maxRequestBodySizeMiddleware(maxRequestBodySize))
+	}
 	ws.Use(cors.Default())
 
 	err := registerValidators()
@@ -61,6 +65,13 @@ func CreateServer(
 	return httpServer, nil
 }
 
+func maxRequestBodySizeMiddleware(maxSize int64) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, maxSize)
+		c.Next()
+	}
+}
+
 func registerValidators() error {
 	validators := []validatorInput{
 		{Name: "skValidator", Validator: skValidator},

api/api_test.go

@@ -0,0 +1,64 @@
+package api
+
+import (
+	"bytes"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/stretchr/testify/require"
+)
+
+func TestMaxRequestBodySizeMiddleware_OversizedBodyShouldErr(t *testing.T) {
+	t.Parallel()
+
+	ws := gin.New()
+	ws.Use(maxRequestBodySizeMiddleware(1 << 20))
+	ws.POST("/test", func(c *gin.Context) {
+		_, err := io.ReadAll(c.Request.Body)
+		if err != nil {
+			c.Status(http.StatusRequestEntityTooLarge)
+			return
+		}
+		c.Status(http.StatusOK)
+	})
+
+	hugeBody := make([]byte, 2*1024*1024)
+	for i := range hugeBody {
+		hugeBody[i] = 'a'
+	}
+
+	req := httptest.NewRequest(http.MethodPost, "/test", bytes.NewReader(hugeBody))
+	resp := httptest.NewRecorder()
+	ws.ServeHTTP(resp, req)
+
+	require.Equal(t, http.StatusRequestEntityTooLarge, resp.Code)
+}
+
+func TestMaxRequestBodySizeMiddleware_NormalBodyShouldPass(t *testing.T) {
+	t.Parallel()
+
+	ws := gin.New()
+	ws.Use(maxRequestBodySizeMiddleware(1 << 20))
+	ws.POST("/test", func(c *gin.Context) {
+		body, err := io.ReadAll(c.Request.Body)
+		if err != nil {
+			c.Status(http.StatusInternalServerError)
+			return
+		}
+		if string(body) != `{"key":"value"}` {
+			c.Status(http.StatusBadRequest)
+			return
+		}
+		c.Status(http.StatusOK)
+	})
+
+	body := []byte(`{"key":"value"}`)
+	req := httptest.NewRequest(http.MethodPost, "/test", bytes.NewReader(body))
+	resp := httptest.NewRecorder()
+	ws.ServeHTTP(resp, req)
+
+	require.Equal(t, http.StatusOK, resp.Code)
+}

cmd/proxy/config/config.toml

@@ -48,6 +48,9 @@
    # TimeBetweenNodesRequestsInSec represents time to wait before retry to get the number of shards from observers
    TimeBetweenNodesRequestsInSec = 2
 
+   # MaxRequestBodySize represents the maximum request body size in bytes for all API endpoints
+   MaxRequestBodySize = 10000000 # 10 MB
+
 [AddressPubkeyConverter]
    #Length specifies the length in bytes of an address
    Length = 32

cmd/proxy/main.go

@@ -611,6 +611,7 @@ func startWebServer(
 		generalConfig.GeneralSettings.RateLimitWindowDurationSeconds,
 		isProfileModeActivated,
 		shouldStartSwaggerUI,
+		generalConfig.GeneralSettings.MaxRequestBodySize,
 	)
 
 	if err != nil {

config/config.go

@@ -19,6 +19,7 @@ type GeneralSettingsConfig struct {
 	AllowEntireTxPoolFetch                   bool
 	NumShardsTimeoutInSec                    int
 	TimeBetweenNodesRequestsInSec            int
+	MaxRequestBodySize                       int64
 }
 
 // Config will hold the whole config file's data

data/transaction.go

@@ -127,6 +127,7 @@ type TransactionSimulationResults struct {
 	ScResults  map[string]*transaction.ApiSmartContractResult `json:"scResults,omitempty"`
 	Receipts   map[string]*transaction.ApiReceipt             `json:"receipts,omitempty"`
 	Hash       string                                         `json:"hash,omitempty"`
+	Logs       *transaction.ApiLogs                           `json:"logs,omitempty"`
 }
 
 // TransactionSimulationResponseData represents the format of the data field of a transaction simulation response

process/scQueryProcessor.go

@@ -59,10 +59,10 @@ func (scQueryProcessor *SCQueryProcessor) ExecuteQuery(query *data.SCQuery) (*vm
 		return nil, data.BlockInfo{}, err
 	}
 
+	request := scQueryProcessor.createRequestFromQuery(query)
+
 	response := data.ResponseVmValue{}
 	for _, observer := range observers {
-		request := scQueryProcessor.createRequestFromQuery(query)
-
 		params := url.Values{}
 		if query.BlockNonce.HasValue {
 			params.Add(blockNonce, fmt.Sprintf("%d", query.BlockNonce.Value))