fix(webhook): cap chunked request bodies

[sgaofen]

Fixes #12543.

Root cause:
The webhook adapter only enforced max_body_bytes from request.content_length. Chunked requests without Content-Length were treated as length zero, then request.read() pulled the full body into memory before validation.

Fix summary:

• Add limited body reading for webhook requests.
• Keep the existing early Content-Length rejection for known oversized bodies.
• Stream no-length/chunked bodies with request.content.iter_chunked() and return 413 as soon as the accumulated body exceeds max_body_bytes.
• Keep a fallback post-read length check for request objects without a stream interface.
• Add a regression proving an oversized no-length chunked request returns 413 without calling request.read() or dispatching the webhook.

Tests:

• uv run --frozen --python 3.11 --extra dev pytest -o addopts= tests/gateway/test_webhook_adapter.py -q -> 37 passed
• git diff --check -- gateway/platforms/webhook.py tests/gateway/test_webhook_adapter.py

[alt-glitch]

Related to PR #3955 — same webhook chunked body limit fix. Maintainers should pick one.

[sgaofen]

Thanks for pointing to #3955. I compared the two patches: #3955 relies on aiohttp client_max_size plus a post-read length check, while this PR enforces max_body_bytes while streaming chunked/no-length bodies and includes a regression that verifies the fallback request.read() path is not used after overflow. If maintainers prefer the older PR I’m fine deferring, but this one is rebased and targets the chunked-body bypass directly.

[egilewski]

stale base

This PR has not incorporated the base branch in 60 days. Please rebase or merge if it's still relevant.

Signed: GPT-5.5-low in Codex

[alt-glitch]

This was generated by AI during triage.

Competing with the earlier open #3955 for the same #12543 chunked-body bypass — #3955 uses aiohttp client_max_size, this PR streams with iter_chunked() and 413s early. Same goal, different mechanism: marked related_to, not a duplicate, for a maintainer to pick.

[teknium1]

Thanks for the focused chunked-body protection work. This is already implemented on current main by the related salvage.

• Automated hermes-sweeper review verified gateway/platforms/webhook.py:216 configures aiohttp with client_max_size=self._max_body_bytes, covering chunked requests without Content-Length.
• gateway/platforms/webhook.py:503 maps aiohttp's overflow exception to HTTP 413, with a post-read byte-length check at gateway/platforms/webhook.py:513.
• tests/gateway/test_webhook_adapter.py:1164 already exercises an oversized chunked request through TestClient and asserts no webhook dispatch.
• This shipped in ec29590a0f193590e24012ff6c165de5ba2930d6 via merged PR fix(gateway): enforce body-size limits on chunked requests (salvage #3955 + #3949) #58536 (f23026f9792640fbc7eb0f8656f256bc85d3bc19), which salvaged related PR fix(webhook): enforce chunked body limits #3955.

Closing as implemented on main.