[CRITICAL] Fix: Add payload size limits and landmark validation to prevent unauthenticated resource exhaustion (#573)

[namann5]

📌 Related Issue

Fixes #573

---

📝 Description

This PR fixes a critical resource exhaustion vulnerability (CVSS 7.5) in the WebSocket frame handler. The server accepted unauthenticated connections with no upper bound on landmarks array size and no per-message size limit, allowing an attacker to exhaust server memory and disk space.

🔹 What has been changed?

1. server/src/config/socket.js — Added \maxHttpBufferSize: 100000\ (~100 KB) to Socket.IO configuration to cap per-message payload size. Previously the Socket.IO default (1 MB) was used, enabling 60 MB/s throughput per connection.

2. server/src/modules/pose/pose.validator.js —

   • Added \LANDMARK_COUNT_MAX = 33\ (MediaPipe Pose uses exactly 33 landmarks). The validator previously only checked a minimum of 29 with no maximum, so attacker could send arrays with 100K+ elements.
   • Added \hasValidLandmarkObject()\ to validate each landmark has numeric \x\ and \y\ properties, preventing malformed NaN values from propagating to angle computation.
   • Updated \hasPoseLandmarks()\ to enforce both bounds and schema.

3. Updated test — \pose.validator.test.js\ now tests upper bound (rejects 34), lower bound (rejects 28), landmark shape validation (rejects missing/non-numeric properties), and valid 29–33 range.

🔹 Why are these changes needed?

Without these limits:

• Any unauthenticated client can connect (default \SOCKET_AUTH_TOKEN\ is empty)
• Each connection can send 60 fps × 1 MB = 60 MB/s
• With 10 concurrent connections/IP, an attacker can consume 600 MB/s bandwidth
• Session buffer stores 300 frames × oversized payloads = up to 300 MB/connection
• On \session:end, all oversized data is persisted to disk

🛠️ Type of Change

• 🐛 Bug Fix (critical security vulnerability)

🧪 Testing

• All 40 backend Vitest tests pass
• Integration tests (socket flow, health, auth) pass
• Validator correctly rejects: arrays >33 elements, arrays <29 elements, objects without numeric x/y

[vercel]

@namann5 is attempting to deploy a commit to the somiljain2024-4175's projects Team on Vercel.

A member of the Team first needs to authorize it.