Fix Unrestricted Resource Consumption in Poem

Unrestricted resource consumption in Poem typically manifests as memory exhaustion via unbounded request bodies. Without explicit limits, an attacker can flood your endpoint with gigabytes of data, triggering OOM kills and service degradation. To secure the application, we must enforce strict payload size limits at the middleware or extractor level to prevent the runtime from attempting to buffer malicious, oversized payloads.

The Vulnerable Pattern

use poem::{handler, post, Route, Body, Server, listener::TcpListener};
#[handler]
async fn upload(body: Body) -> String {
// VULNERABLE: Reads the entire body into memory without any size checks
let data = body.into_bytes().await.unwrap();
format!(“Received {} bytes”, data.len())
}
#[tokio::main]
async fn main() {
let app = Route::new().at(“/upload”, post(upload));
Server::new(TcpListener::bind(“127.0.0.1:3000”))
.run(app)
.await
.unwrap();
}

The Secure Implementation

The vulnerable code uses `body.into_bytes()` which attempts to buffer the entire incoming stream into a `Bytes` object. An attacker can send a multi-gigabyte stream, causing the process to exhaust available RAM. The secure implementation wraps the route with the `SizeLimit` middleware. This middleware checks the `Content-Length` header and monitors the actual stream size during transit. If the limit (e.g., 1MB) is exceeded, Poem automatically terminates the connection and returns a '413 Payload Too Large' response before the handler can allocate excessive memory, effectively neutralizing the DoS vector.

use poem::{handler, post, Route, Body, Server, listener::TcpListener, middleware::SizeLimit, endpoint::EndpointExt};
#[handler]
async fn upload(body: Body) -> String {
// The middleware ensures we never reach here if the body is too large
let data = body.into_bytes().await.unwrap();
format!(“Received {} bytes”, data.len())
}
#[tokio::main]
async fn main() {
// SECURE: Apply SizeLimit middleware to restrict payload to 1MB
let app = Route::new()
.at(“/upload”, post(upload))
.with(SizeLimit::new(1024 * 1024));
Server::new(TcpListener::bind("127.0.0.1:3000"))
    .run(app)
    .await
    .unwrap();
}