Enforcing a maximum HTTP request content length limits how much data the server must accept per request, which helps control resource use and reduces the risk of denial-of-service attacks.
Accepting HTTP requests without an upper bound on their content length exposes the application to Denial of Service (DoS) attacks. An attacker can send arbitrarily large requests that exhaust server memory, disk space, or processing capacity before the application can reject them. This rule detects when no maximum content length is configured, or when the configured limit exceeds the recommended thresholds (8 MB for file uploads, 2 MB for other requests).
An attacker who can send oversized HTTP requests can exhaust server resources—memory, CPU threads, or network bandwidth—causing the application to slow down or become completely unavailable. Even a single large upload can tie up a worker process and prevent other users from being served.
Set maxSize in the Assert\File constraint to limit the size of uploaded files to 8 MB or less.
use Symfony\Component\Validator\Constraints as Assert;
use Symfony\Component\Validator\Mapping\ClassMetadata;
class TestEntity
{
public static function loadValidatorMetadata(ClassMetadata $metadata)
{
$metadata->addPropertyConstraint('upload', new Assert\File([
'maxSize' => '100M', // Noncompliant
]));
}
}
use Symfony\Component\Validator\Constraints as Assert;
use Symfony\Component\Validator\Mapping\ClassMetadata;
class TestEntity
{
public static function loadValidatorMetadata(ClassMetadata $metadata)
{
$metadata->addPropertyConstraint('upload', new Assert\File([
'maxSize' => '8M',
]));
}
}
Add the max validation rule to restrict the size of uploaded files.
use App\Http\Controllers\Controller;
use Illuminate\Http\Request;
class TestController extends Controller
{
public function test(Request $request)
{
$validatedData = $request->validate([
'upload' => 'required|file', // Noncompliant
]);
}
}
use App\Http\Controllers\Controller;
use Illuminate\Http\Request;
class TestController extends Controller
{
public function test(Request $request)
{
$validatedData = $request->validate([
'upload' => 'required|file|max:8000',
]);
}
}