Limit input size for Prometheus alert JSON payload

ee/app/services/projects/prometheus/alerts/notify_service.rb

@@ -4,6 +4,8 @@ module Projects
   module Prometheus
     module Alerts
       class NotifyService < BaseService
+        BadPayloadError = Class.new(StandardError)
+
         include Gitlab::Utils::StrongMemoize
 
         def execute(token)
@@ -15,10 +17,18 @@ module Projects
           process_incident_issues if process_issues?
 
           true
+        rescue BadPayloadError
+          false
         end
 
         private
 
+        def payload
+          raise BadPayloadError, 'The payload is too big' unless Gitlab::Utils::DeepSize.new(params).valid?
+
+          params
+        end
+
         def incident_management_available?
           project.feature_available?(:incident_management)
         end
@@ -56,11 +66,11 @@ module Projects
         end
 
         def alerts
-          params['alerts']
+          payload['alerts']
         end
 
         def valid_version?
-          params['version'] == '4'
+          payload['version'] == '4'
         end
 
         def valid_alert_manager_token?(token)
@@ -134,7 +144,7 @@ module Projects
         end
 
         def persist_events
-          CreateEventsService.new(project, nil, params).execute
+          CreateEventsService.new(project, nil, payload).execute
         end
       end
     end

ee/spec/services/projects/prometheus/alerts/notify_service_spec.rb

@@ -338,6 +338,22 @@ describe Projects::Prometheus::Alerts::NotifyService do
 
       it_behaves_like 'no notifications'
     end
+
+    context 'when the payload is too big' do
+      let(:payload) { { 'the-payload-is-too-big' => true } }
+      let(:deep_size_object) { instance_double(Gitlab::Utils::DeepSize, valid?: false) }
+
+      before do
+        allow(Gitlab::Utils::DeepSize).to receive(:new).and_return(deep_size_object)
+      end
+
+      it_behaves_like 'no notifications'
+
+      it 'does not process issues' do
+        expect(IncidentManagement::ProcessPrometheusAlertWorker)
+          .not_to receive(:perform_async)
+      end
+    end
   end
 
   private