8 Uses of deprecated API can be used to cause DoS in user-facing endpoints

[whynowy]

Severity	Medium
Difficulty	Medium
Target

Several HandleRoute endpoints make use of the deprecated ioutil.ReadAll(). ioutil.ReadAll() reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service.

Eventsources susceptible to an out-of-memory denial-of-service attack:

1. AWS SNS

2. Bitbucket

3. Bitbucket Server

4. Gitlab

5. Slack

6. Storagegrid

7. Webhook

Note that the Stripe Event Source uses ioutil.ReadAll() but limits the size of the request body: https://github.com/argoproj/argo-events/blob/master/eventsources/sources/stripe/start.go#L77

Since io/ioutil has ceased maintenance we recommend discontinuing all use of this package.Severity Medium Difficulty Medium Target

Several HandleRoute endpoints make use of the deprecated ioutil.ReadAll(). ioutil.ReadAll() reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service.

Eventsources susceptible to an out-of-memory denial-of-service attack:
AWS SNS
Bitbucket
Bitbucket Server
Gitlab
Slack
Storagegrid
Webhook

Note that the Stripe Event Source uses ioutil.ReadAll() but limits the size of the request body: https://github.com/argoproj/argo-events/blob/master/eventsources/sources/stripe/start.go#L77

Since io/ioutil has ceased maintenance we recommend discontinuing all use of this package.