RocketChat / RocketChat/Rocket.Chat
Unbounded Memory Consumption in Avatar URL Uploads (P1)
Open
Nobody has claimed this yet.
type: bug
- Dominant language
- TypeScript
- Stars
- 46.1k
- Forks
- 13.9k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 130
Description
Issue: Unbounded Memory Consumption in Avatar URL Uploads (P1)
Severity: High
Description
Any authenticated user can point avatarUrl to an external resource serving arbitrarily large response. Server loads entire response into memory via response.arrayBuffer() without size limits.
Vulnerable Code Locations
app/lib/server/functions/setUserAvatar.ts:106-arrayBuffer()callapp/lib/server/functions/setUserAvatar.ts:161- fetch without size limit
Attack Vector
- Attacker sets avatar URL to large file (e.g., 1GB+)
- Server fetches and buffers entire response in memory
- Multiple concurrent requests cause OOM crash
Fix
- Added
bufferResponseWithLimit()for streaming with size enforcement - Content-Length validation before downloading
- Streaming abort when threshold exceeded
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading app/lib/server/functions/setUserAvatar.ts at lines 106 and 161, focusing on the avatar URL fetch and response buffering. Verify behavior with responses that exceed the permitted size; done means Content-Length is checked and streaming stops when the threshold is exceeded without unbounded memory use.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 52/100