Fix Unrestricted Resource Consumption in Gin

package main
import “github.com/gin-gonic/gin”
func main() {
r := gin.Default()
r.POST(“/upload”, func(c *gin.Context) {
// VULNERABILITY: No limit on request body size.
// An attacker can send a multi-gigabyte payload to crash the service.
file, _ := c.FormFile(“file”)
c.SaveUploadedFile(file, “/tmp/” + file.Filename)
c.String(200, “Uploaded”)
})
r.Run(“:8080”) // VULNERABILITY: r.Run() uses default http.Server with no timeouts.
}

package main
import (
“github.com/gin-gonic/gin”
“net/http”
“time”
)
func main() {
r := gin.New()
// 1. Limit memory used for multipart forms (default is 32MB, lowering to 8MB)
r.MaxMultipartMemory = 8 << 20

// 2. Global Middleware to restrict request body size to 2MB
r.Use(func(c *gin.Context) {
	c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, 2<<20)
	c.Next()
})

r.POST("/upload", func(c *gin.Context) {
	file, err := c.FormFile("file")
	if err != nil {
		c.AbortWithStatusJSON(http.StatusRequestEntityTooLarge, gin.H{"error": "Payload too large"})
		return
	}
	c.SaveUploadedFile(file, "/tmp/"+file.Filename)
})

// 3. Hardened HTTP Server with explicit timeouts
s := &http.Server{
	Addr:           ":8080",
	Handler:        r,
	ReadTimeout:    5 * time.Second,
	WriteTimeout:   10 * time.Second,
	IdleTimeout:    15 * time.Second,
	MaxHeaderBytes: 1 << 20, // 1MB
}
s.ListenAndServe()
}