From 28478efe1c387a3a52c92cb28e7bbb3552c7530b Mon Sep 17 00:00:00 2001
From: Alfonso Acosta <alfonso@stellar.org>
Date: Thu, 24 Aug 2023 20:06:31 +0200
Subject: [PATCH] soroban-rpc: Limit request size to 10MB (#898)

---
 cmd/soroban-rpc/internal/jsonrpc.go | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/cmd/soroban-rpc/internal/jsonrpc.go b/cmd/soroban-rpc/internal/jsonrpc.go
index ca55f36a2..4c6747316 100644
--- a/cmd/soroban-rpc/internal/jsonrpc.go
+++ b/cmd/soroban-rpc/internal/jsonrpc.go
@@ -266,7 +266,7 @@ func NewJSONRPCHandler(cfg *config.Config, params HandlerParams) Handler {
 		Namespace: params.Daemon.MetricsNamespace(), Subsystem: "network", Name: "global_request_execution_duration_threshold_limit",
 		Help: "The metric measures the count of requests that surpassed the limit threshold for execution time",
 	})
-	durationLimitedBridge := network.MakeHTTPRequestDurationLimiter(
+	var handler http.Handler = network.MakeHTTPRequestDurationLimiter(
 		queueLimitedBridge,
 		cfg.RequestExecutionWarningThreshold,
 		cfg.MaxRequestExecutionDuration,
@@ -274,9 +274,12 @@ func NewJSONRPCHandler(cfg *config.Config, params HandlerParams) Handler {
 		globalQueueRequestExecutionDurationLimitCounter,
 		params.Logger)
 
+	// Limit request sizes to 10MB
+	handler = http.MaxBytesHandler(handler, 1024*1024*10)
+
 	return Handler{
 		bridge:  bridge,
 		logger:  params.Logger,
-		Handler: durationLimitedBridge,
+		Handler: handler,
 	}
 }