From bf3a12a9600e6df5e931b0f3585b8dcc97164cd3 Mon Sep 17 00:00:00 2001 From: Andrew Mellor Date: Thu, 23 Apr 2026 16:01:09 +0100 Subject: [PATCH] Updated eula pdf upload size check to default max request body size (#43517) **Related issue:** Resolves #40856 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Summary by CodeRabbit * **Bug Fixes** * EULA PDF upload size validation now reports the configured maximum upload size (in MiB) instead of a fixed value, improving clarity of rejection messages. * **Tests** * Added tests covering EULA upload size validation, ensuring oversized uploads are rejected with the proper status and that configured request-body limits are respected. --- ...to-default-max-request-body-size-and-error | 1 + server/service/integration_mdm_test.go | 29 +++++++++++++++++++ server/service/mdm.go | 2 +- 3 files changed, 31 insertions(+), 1 deletion(-) create mode 100644 changes/40856-eula-upload-updated-to-default-max-request-body-size-and-error diff --git a/changes/40856-eula-upload-updated-to-default-max-request-body-size-and-error b/changes/40856-eula-upload-updated-to-default-max-request-body-size-and-error new file mode 100644 index 0000000000..b6ee62044a --- /dev/null +++ b/changes/40856-eula-upload-updated-to-default-max-request-body-size-and-error @@ -0,0 +1 @@ +- Updated to default max request body size for eula pdf upload size check diff --git a/server/service/integration_mdm_test.go b/server/service/integration_mdm_test.go index 7fb30eab95..81508b5d55 100644 --- a/server/service/integration_mdm_test.go +++ b/server/service/integration_mdm_test.go @@ -39,6 +39,7 @@ import ( "github.com/MicahParks/jwkset" "github.com/davecgh/go-spew/spew" + "github.com/docker/go-units" "github.com/fleetdm/fleet/v4/server/dev_mode" "github.com/fleetdm/fleet/v4/server/mdm/acme/testhelpers" "github.com/fleetdm/fleet/v4/server/mdm/android" @@ -48,6 +49,7 @@ import ( "github.com/fleetdm/fleet/v4/server/mdm/android/tests" "github.com/fleetdm/fleet/v4/server/mdm/apple/apple_apps" "github.com/fleetdm/fleet/v4/server/mdm/assets" + platform_http "github.com/fleetdm/fleet/v4/server/platform/http" "github.com/fleetdm/fleet/v4/server/pubsub" "github.com/golang-jwt/jwt/v4" "google.golang.org/api/androidmanagement/v1" @@ -4590,6 +4592,33 @@ func (s *integrationMDMTestSuite) TestEULA() { // trying to upload an empty file fails s.uploadEULA(&fleet.MDMEULA{Bytes: []byte{}, Name: "should-fail.pdf"}, http.StatusBadRequest, "invalid file type") + // file larger than the max EULA size should be rejected by the request size limit + largePDF := append( + []byte("%PDF-1.7\n"), + bytes.Repeat([]byte("A"), int(fleet.MaxEULASize)+1-len("%PDF-1.7\n"))..., + ) + + s.uploadEULA(&fleet.MDMEULA{Bytes: largePDF, Name: "oversize.pdf"}, http.StatusRequestEntityTooLarge, "Request exceeds the max size limit") + + // Test with MaxRequestBodySize set to unlimited (-1) - the endpoint still enforces the EULA request body limit + oldLimit := platform_http.MaxRequestBodySize + platform_http.MaxRequestBodySize = -1 + largePDFUnlimited := append( + []byte("%PDF-1.7\n"), + bytes.Repeat([]byte("A"), int(fleet.MaxEULASize)+1-len("%PDF-1.7\n"))..., + ) + s.uploadEULA(&fleet.MDMEULA{Bytes: largePDFUnlimited, Name: "oversize_unlimited.pdf"}, http.StatusRequestEntityTooLarge, "Request exceeds the max size limit") + platform_http.MaxRequestBodySize = oldLimit + + // Test with MaxRequestBodySize larger than MaxEULASize - should reject at MaxRequestBodySize + platform_http.MaxRequestBodySize = 50 * units.MiB + largePDFLarge := append( + []byte("%PDF-1.7\n"), + bytes.Repeat([]byte("A"), int(50*units.MiB)+1-len("%PDF-1.7\n"))..., + ) + s.uploadEULA(&fleet.MDMEULA{Bytes: largePDFLarge, Name: "oversize_large.pdf"}, http.StatusRequestEntityTooLarge, "Request exceeds the max size limit") + platform_http.MaxRequestBodySize = oldLimit + // admin is able to upload a new EULA s.uploadEULA(&fleet.MDMEULA{Bytes: pdfBytes, Name: pdfName}, http.StatusOK, "") diff --git a/server/service/mdm.go b/server/service/mdm.go index b154383e69..49cd95deb8 100644 --- a/server/service/mdm.go +++ b/server/service/mdm.go @@ -269,7 +269,7 @@ func (createMDMEULARequest) DecodeRequest(ctx context.Context, r *http.Request) if eula.Size > fleet.MaxEULASize { return nil, &fleet.BadRequestError{ - Message: "Uploaded EULA exceeds maximum allowed size of 500 MiB", + Message: fmt.Sprintf("Uploaded EULA exceeds maximum allowed size of %d MiB", fleet.MaxEULASize/1024/1024), } }