Harden external file connector boundaries

src/govoplan_files/backend/storage/backends.py

@@ -4,6 +4,12 @@ from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Iterable, Protocol
 
+from govoplan_core.security.outbound_http import (
+    OutboundHttpError,
+    response_limit,
+    validate_unpinned_sdk_http_url,
+)
+
 from govoplan_files.backend.runtime import settings
 
 
@@ -96,15 +102,25 @@ class S3StorageBackend:
             import boto3
         except ModuleNotFoundError as exc:
             raise StorageBackendError("boto3 is required for the S3 storage backend") from exc
-        return boto3.client(
-            "s3",
-            endpoint_url=self.endpoint_url,
-            region_name=self.region_name,
-            aws_access_key_id=self.access_key_id,
-            aws_secret_access_key=self.secret_access_key,
-        )
+        try:
+            endpoint_url = validate_unpinned_sdk_http_url(
+                self.endpoint_url,
+                label="File storage S3 endpoint",
+            )
+            return boto3.client(
+                "s3",
+                endpoint_url=endpoint_url,
+                region_name=self.region_name,
+                aws_access_key_id=self.access_key_id,
+                aws_secret_access_key=self.secret_access_key,
+            )
+        except OutboundHttpError as exc:
+            raise StorageBackendError(str(exc)) from exc
 
     def put_bytes(self, key: str, data: bytes, *, content_type: str | None = None) -> None:
+        max_bytes = response_limit("file")
+        if len(data) > max_bytes:
+            raise StorageBackendError(f"Stored object exceeds the deployment limit of {max_bytes} bytes")
         kwargs = {"Bucket": self.bucket, "Key": key, "Body": data}
         if content_type:
             kwargs["ContentType"] = content_type
@@ -113,19 +129,39 @@ class S3StorageBackend:
     def get_bytes(self, key: str) -> bytes:
         try:
             obj = self.client.get_object(Bucket=self.bucket, Key=key)
-            return obj["Body"].read()
+            max_bytes = response_limit("file")
+            body = obj["Body"]
+            try:
+                _reject_declared_object_size(obj, max_bytes=max_bytes)
+                data = body.read(max_bytes + 1)
+                if len(data) > max_bytes:
+                    raise StorageBackendError(f"Stored object exceeds the deployment limit of {max_bytes} bytes")
+                return data
+            finally:
+                if hasattr(body, "close"):
+                    body.close()
         except Exception as exc:  # pragma: no cover - depends on S3 backend
             raise StorageBackendError(str(exc)) from exc
 
     def iter_bytes(self, key: str, *, chunk_size: int = 1024 * 1024) -> Iterable[bytes]:
         try:
             obj = self.client.get_object(Bucket=self.bucket, Key=key)
+            max_bytes = response_limit("file")
             body = obj["Body"]
-            while True:
-                chunk = body.read(chunk_size)
-                if not chunk:
-                    break
-                yield chunk
+            try:
+                _reject_declared_object_size(obj, max_bytes=max_bytes)
+                total = 0
+                while True:
+                    chunk = body.read(chunk_size)
+                    if not chunk:
+                        break
+                    total += len(chunk)
+                    if total > max_bytes:
+                        raise StorageBackendError(f"Stored object exceeds the deployment limit of {max_bytes} bytes")
+                    yield chunk
+            finally:
+                if hasattr(body, "close"):
+                    body.close()
         except Exception as exc:  # pragma: no cover - depends on S3 backend
             raise StorageBackendError(str(exc)) from exc
 
@@ -140,6 +176,17 @@ class S3StorageBackend:
             return False
 
 
+def _reject_declared_object_size(obj: object, *, max_bytes: int) -> None:
+    if not isinstance(obj, dict):
+        return
+    try:
+        declared_size = int(obj.get("ContentLength"))
+    except (TypeError, ValueError):
+        return
+    if declared_size > max_bytes:
+        raise StorageBackendError(f"Stored object exceeds the deployment limit of {max_bytes} bytes")
+
+
 def _fallback_roots() -> tuple[Path, ...]:
     raw = getattr(settings, "file_storage_local_fallback_roots", "") or ""
     return tuple(Path(item.strip()) for item in str(raw).split(",") if item.strip())