[MEDIUM] Resource limits missing for downloads and WebSocket

[MacJediWizard]

Description

The agent lacks size limits on binary downloads and WebSocket messages, creating denial of service risks.

Issues

1. Unbounded Binary Download

Location: cmd/patchmon-agent/commands/version_update.go:432

binaryData, err := io.ReadAll(resp.Body)

A malicious server could exhaust memory.

2. Unbounded WebSocket Messages

Location: cmd/patchmon-agent/commands/serve.go:441

for {
    _, data, err := conn.ReadMessage()

No message size limit set.

Recommended Fixes

For binary download:

const maxBinarySize = 100 * 1024 * 1024 // 100MB max
limitedReader := io.LimitReader(resp.Body, maxBinarySize)
binaryData, err := io.ReadAll(limitedReader)

For WebSocket:

conn.SetReadLimit(64 * 1024) // 64KB max message size

Severity

🟡 MEDIUM - Denial of service risk