[Security] Missing input validation in master_api — potential DoS via large payloads

[sulthonzh]

[Security] Missing input validation in master_api.go task handler — potential DoS via large payloads

Description

The masterTaskHandle.Process function accepts task data from slave nodes without any size validation. A malicious slave can send arbitrarily large payloads, causing memory exhaustion or blocking the master node during JSON marshaling.

Context

• File: app/distribute/master_api.go
• Function: masterTaskHandle.Process (lines 21-28)

Current vs Expected Behavior

Current:
func (mth *masterTaskHandle) Process(receive *teleport.NetData) *teleport.NetData {
b := result.Ret(json.Marshal(mth.Send(mth.CountNodes())))
if b.IsErr() {
return teleport.ReturnError(receive, teleport.FAILURE, "marshal error: "+b.UnwrapErr().Error(), receive.From)
}
return teleport.ReturnData(string(b.Unwrap()))
}

The receive parameter (teleport.NetData) can contain an arbitrarily large Body field. When processing subsequent tasks or responses, there's no limit on the size of data accepted from network peers.

Expected:
Validate payload sizes and implement rate limiting per peer.

Suggested Fix

1. Add a max payload size constant:
   const maxNetDataSize = 10 * 1024 * 1024 // 10MB

2. Validate in the NetData creation or in the Process handler:
   func (mth *masterTaskHandle) Process(receive *teleport.NetData) *teleport.NetData {
   // Validate payload size
   if len(receive.Body) > maxNetDataSize {
   return teleport.ReturnError(receive, teleport.FAILURE, "payload too large", receive.From)
   }

   b := result.Ret(json.Marshal(mth.Send(mth.CountNodes())))
   if b.IsErr() {
   return teleport.ReturnError(receive, teleport.FAILURE, "marshal error: "+b.UnwrapErr().Error(), receive.From)
   }
   return teleport.ReturnData(string(b.Unwrap()))
   }

3. Consider adding:

• Per-peer rate limiting (max requests per second)
• Per-peer memory quota tracking
• Connection-level throttling

Impact

• Severity: Medium
• Affected: All users in distributed mode (server)
• Attack vector: Malicious slave nodes sending large payloads to exhaust memory or CPU
• Risk: Denial of service

Positively — happy to submit a PR if this is welcome.