fix(webhook): enforce body-size limit when Content-Length is absent

[Tamsi]

Summary

The generic webhook adapter (gateway/platforms/webhook.py) enforced its per-route max_body_bytes limit only via the Content-Length header:

content_length = request.content_length or 0
if content_length > self._max_body_bytes:
    return web.json_response({"error": "Payload too large"}, status=413)
raw_body = await request.read()   # reads the whole body, no re-check

A request using Transfer-Encoding: chunked (or a spoofed small Content-Length) makes request.content_length None, so None or 0 == 0 and the check is skipped entirely. The full body is then buffered into memory regardless of the route's configured max_body_bytes.

This is reachable by an unauthenticated caller — the body must be read before HMAC signature verification — so it bypasses the documented size guard and is a DoS vector on an internet-exposed webhook endpoint. The module docstring even claims "Body size limits checked before reading payload", which chunked requests defeat.

The sibling adapters Feishu (plugins/platforms/feishu/adapter.py) and WeCom already guard this exact case with a post-read length check and have regression tests for content_length=None — the generic adapter was the odd one out.

Fix

• Re-check the limit against the bytes actually read (len(raw_body) > self._max_body_bytes → 413), keeping the Content-Length fast path.
• Update the module docstring to reflect the real guarantee.
• Add a regression test driving a chunked-style request (Content-Length None) with an over-limit body, asserting 413.

Test plan

• tests/gateway/test_webhook_adapter.py — 69 passed (68 existing + 1 new)
• Full webhook suite (test_webhook_adapter, test_webhook_signature_rate_limit, test_webhook_integration, test_webhook_dynamic_routes, test_webhook_deliver_only) — 103 passed
• Confirmed the new test fails without the fix (returns 202 instead of 413) and passes with it

[alt-glitch]

This was generated by AI during triage.

Competing-PR cluster for the same generic-webhook chunked-body bypass: this PR (post-read len(raw_body) re-check), open #3955 (earliest/canonical — aiohttp client_max_size + post-read check, different mechanism), and open #13336 (streams via iter_chunked(), 413 once the accumulated body exceeds the limit). Same goal, different mechanisms → related, not duplicate. #3955 is the earliest/canonical entry; a maintainer should pick one. Per-adapter siblings that fix the same class elsewhere: #25296 (MS Graph), #54935 (Feishu), #54930 (LINE).

[teknium1]

Thanks @Tamsi — reviewed against current origin/main: this was fixed by PR #58536 (commit ec29590, merged 2026-07-04), which enforces the cap on the actual bytes read plus sets client_max_size on the aiohttp Application, covering both chunked and spoofed-Content-Length requests with regression tests. Closing as already fixed on main. Thanks for the correct diagnosis — if you see any remaining bypass on current main, a fresh report is welcome.