diff --git a/.changeset/shiny-pears-admire.md b/.changeset/shiny-pears-admire.md new file mode 100644 index 00000000000..0e8287d708f --- /dev/null +++ b/.changeset/shiny-pears-admire.md @@ -0,0 +1,5 @@ +--- +'@rocket.chat/meteor': patch +--- + +Limits `Outgoing webhook` maximum response size to 10mb. diff --git a/apps/meteor/app/integrations/server/lib/triggerHandler.ts b/apps/meteor/app/integrations/server/lib/triggerHandler.ts index 192419d6c21..43f48269930 100644 --- a/apps/meteor/app/integrations/server/lib/triggerHandler.ts +++ b/apps/meteor/app/integrations/server/lib/triggerHandler.ts @@ -621,6 +621,7 @@ class RocketChatIntegrationHandler { ...(opts.data && { body: opts.data }), // SECURITY: Integrations can only be configured by users with enough privileges. It's ok to disable this check here. ignoreSsrfValidation: true, + size: 10 * 1024 * 1024, }, settings.get('Allow_Invalid_SelfSigned_Certs'), )