Ignore incoming channelling messages larger than 1MB.

src/app/spreed-webrtc-server/client.go

@@ -71,8 +71,7 @@ func (client *client) OnText(b Buffer) {
 	if incoming, err := client.DecodeIncoming(b); err == nil {
 		client.OnIncoming(client, client.session, incoming)
 	} else {
-		log.Println("OnText error while decoding JSON", err)
+		log.Println("OnText error while processing incoming message", err)
-		log.Printf("JSON:\n%s\n", b)
 	}
 }
 

src/app/spreed-webrtc-server/incoming_codec.go

@@ -24,6 +24,7 @@ package main
 import (
 	"bytes"
 	"encoding/json"
+	"errors"
 	"log"
 )
 
@@ -42,11 +43,12 @@ type Codec interface {
 }
 
 type incomingCodec struct {
-	buffers BufferCache
+	buffers       BufferCache
+	incomingLimit int
 }
 
-func NewCodec() Codec {
+func NewCodec(incomingLimit int) Codec {
-	return &incomingCodec{NewBufferCache(1024, bytes.MinRead)}
+	return &incomingCodec{NewBufferCache(1024, bytes.MinRead), incomingLimit}
 }
 
 func (codec incomingCodec) NewBuffer() Buffer {
@@ -54,6 +56,10 @@ func (codec incomingCodec) NewBuffer() Buffer {
 }
 
 func (codec incomingCodec) DecodeIncoming(b Buffer) (*DataIncoming, error) {
+	length := b.GetBuffer().Len()
+	if length > codec.incomingLimit {
+		return nil, errors.New("Incoming message size limit exceeded")
+	}
 	incoming := &DataIncoming{}
 	return incoming, json.Unmarshal(b.Bytes(), incoming)
 }

src/app/spreed-webrtc-server/main.go

@@ -280,6 +280,9 @@ func runner(runtime phoenix.Runtime) error {
 		log.Printf("Loaded extra templates from: %s", extraFolder)
 	}
 
+	// Define incoming channeling API limit it byte. Larger messages will be discarded.
+	incomingCodecLimit := 1024 * 1024 // 1MB
+
 	// Create realm string from config.
 	computedRealm := fmt.Sprintf("%s.%s", serverRealm, config.Token)
 
@@ -336,7 +339,7 @@ func runner(runtime phoenix.Runtime) error {
 
 	// Add handlers.
 	buddyImages := NewImageCache()
-	codec := NewCodec()
+	codec := NewCodec(incomingCodecLimit)
 	roomManager := NewRoomManager(config, codec)
 	hub := NewHub(config, sessionSecret, encryptionSecret, turnSecret, codec)
 	tickets := NewTickets(sessionSecret, encryptionSecret, computedRealm)