security: bound Content-Length parsing in viewer server

[Sunil56224972]

Summary

The viewer server's _read_body() method has two issues with Content-Length handling:

1. Unbounded memory allocation (OOM DoS) — Medium Severity

A client can send Content-Length: 999999999999 and force the server to attempt allocating an enormous buffer via self.rfile.read(length), causing an out-of-memory denial of service against the viewer process.

Fix: Added _MAX_BODY_BYTES = 2 * 1024 * 1024 (2 MiB) cap. Any Content-Length above this limit causes _read_body() to return an empty dict, so the endpoint returns its normal validation error.

2. Unhandled ValueError on malformed Content-Length — Low Severity

int(self.headers.get('Content-Length') or 0) raises ValueError if the header contains a non-integer value (e.g. 'abc' or '12,34'). The outer except Exception catches it but produces a 500 + full stack trace in logs for what should be a malformed request.

Fix: Wrapped the int() conversion in try/except (ValueError, OverflowError) so malformed headers degrade gracefully.

Files changed

• strix/viewer/server.py

Testing

• Verified the fix preserves all existing endpoint behavior for valid requests
• Invalid/oversized Content-Length values now return empty body (endpoints handle this via their existing validation)

[greptile-apps]

Greptile Summary

The PR hardens viewer request-body parsing.

• Caps declared request bodies at 2 MiB.
• Treats malformed, negative, and oversized Content-Length values as empty bodies.

Confidence Score: 5/5

The PR appears safe to merge with no actionable issues identified.

The viewer now rejects invalid or excessive declared body lengths before reading them, while valid request bodies continue through the existing JSON parsing path.

Important Files Changed

Filename	Overview
strix/viewer/server.py	Adds bounded and exception-safe Content-Length parsing without introducing an actionable defect.

_{Reviews (1): Last reviewed commit: "security: bound Content-Length parsing i..." | Re-trigger Greptile}