[Security] Missing input validation in master_api — potential DoS via large payloads

[Security] Missing input validation in master_api.go task handler — potential DoS via large payloads

Description

The masterTaskHandle.Process function accepts task data from slave nodes without any size validation. A malicious slave can send arbitrarily large payloads, causing memory exhaustion or blocking the master node during JSON marshaling.

Context

• File: app/distribute/master_api.go
• Function: masterTaskHandle.Process (lines 21-28)

Current vs Expected Behavior

Current: func (mth *masterTaskHandle) Process(receive *teleport.NetData) *teleport.NetData { b := result.Ret(json.Marshal(mth.Send(mth.CountNodes()))) if b.IsErr() { return teleport.ReturnError(receive, teleport.FAILURE, "marshal error: "+b.UnwrapErr().Error(), receive.From) } return teleport.ReturnData(string(b.Unwrap())) }

The receive parameter (teleport.NetData) can contain an arbitrarily large Body field. When processing subsequent tasks or responses, there's no limit on the size of data accepted from network peers.

Expected: Validate payload sizes and implement rate limiting per peer.

Suggested Fix

1. Add a max payload size constant: const maxNetDataSize = 10 * 1024 * 1024 // 10MB

2. Validate in the NetData creation or in the Process handler: func (mth *masterTaskHandle) Process(receive *teleport.NetData) *teleport.NetData { // Validate payload size if len(receive.Body) > maxNetDataSize { return teleport.ReturnError(receive, teleport.FAILURE, "payload too large", receive.From) }

   b := result.Ret(json.Marshal(mth.Send(mth.CountNodes()))) if b.IsErr() { return teleport.ReturnError(receive, teleport.FAILURE, "marshal error: "+b.UnwrapErr().Error(), receive.From) } return teleport.ReturnData(string(b.Unwrap())) }

3. Consider adding:

• Per-peer rate limiting (max requests per second)
• Per-peer memory quota tracking
• Connection-level throttling

Impact

• Severity: Medium
• Affected: All users in distributed mode (server)
• Attack vector: Malicious slave nodes sending large payloads to exhaust memory or CPU
• Risk: Denial of service

Positively — happy to submit a PR if this is welcome.