MM-22057: Limit incoming request bodies (#13827)

* MM-22057: Limit incoming request bodies

Set the max request body size to be equal to MaxFileSize.
Ideally, non-file request bodies should be smaller than file request bodies,
but we don't have a clean way to identify all file upload handlers.

There shouldn't be any valid request which exceeds the max file upload size.
So this is a safe global limit to apply.

* Fix tests

Co-authored-by: mattermod <mattermod@users.noreply.github.com>

web/handlers.go

@@ -4,6 +4,7 @@
 package web
 
 import (
+	"bytes"
 	"fmt"
 	"net/http"
 	"reflect"
@@ -90,6 +91,14 @@ func (h Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	c.App.Path = r.URL.Path
 	c.Log = c.App.Log
 
+	// Set the max request body size to be equal to MaxFileSize.
+	// Ideally, non-file request bodies should be smaller than file request bodies,
+	// but we don't have a clean way to identify all file upload handlers.
+	// So to keep it simple, we clamp it to the max file size.
+	// We add a buffer of bytes.MinRead so that file sizes close to max file size
+	// do not get cut off.
+	r.Body = http.MaxBytesReader(w, r.Body, *c.App.Config().FileSettings.MaxFileSize+bytes.MinRead)
+
 	subpath, _ := utils.GetSubpathFromConfig(c.App.Config())
 	siteURLHeader := app.GetProtocol(r) + "://" + r.Host + subpath
 	c.SetSiteURLHeader(siteURLHeader)