Security: enforce max Content-Length on metrics responses

[quanticsoul4772]

@claude
Set MAX_METRICS_BYTES (default 1 MB); if exceeded return 413.

Test
Artificially large metrics payload → 413 Payload Too Large.

[claude]

Claude finished @quanticsoul4772's task —— View job • claude/issue-45-20250806-0216 • Create PR ➔

---

Security: Enforce Max Content-Length on Metrics Responses ✅

Successfully implemented security enforcement for max Content-Length on metrics responses to prevent potential DoS attacks.

Todo List:

• Read CLAUDE.md for repo-specific guidelines
• Explore codebase to understand metrics implementation
• Implement MAX_METRICS_BYTES limit (default 1 MB)
• Add 413 Payload Too Large response handling
• Create/update tests for size limit functionality
• Run linting and tests
• Commit and push changes

✨ Implementation Summary

Features Added:

• Added MAX_METRICS_BYTES configuration (default: 1MB)
• Content-length checking before sending responses
• HTTP 413 "Payload Too Large" response for oversized metrics
• Environment variable support: MAX_METRICS_BYTES
• Proper multi-byte character handling with Buffer.byteLength()

Files Modified:

• src/utils/metrics_server.ts - Core security implementation
• src/utils/__tests__/metrics_server.test.ts - Added config test
• src/utils/__tests__/metrics_server_content_limit.test.ts - Comprehensive test suite

Security Enhancement Details:

// Check if content exceeds maximum allowed size
if (contentLength > this.config.maxMetricsBytes!) {
  Logger.warn(`Metrics response size (${contentLength} bytes) exceeds limit (${this.config.maxMetricsBytes} bytes)`);
  this.sendError(res, 413, 'Payload Too Large');
  return;
}

Testing:

• ✅ Configuration validation
• ✅ Size limit enforcement
• ✅ HTTP 413 error responses
• ✅ Multi-byte character handling
• ✅ Edge cases (empty responses, exact limits)

---