Merge branch 'limit-input-size-for-prometheus-alert-payload' into 'master'

Limit input size for Prometheus alert JSON payload

Closes #14929

See merge request gitlab-org/gitlab!19940

ee/app/services/projects/prometheus/alerts/notify_service.rb

@@ -7,6 +7,7 @@ module Projects
         include Gitlab::Utils::StrongMemoize
 
         def execute(token)
+          return false unless valid_payload_size?
           return false unless valid_version?
           return false unless valid_alert_manager_token?(token)
 
@@ -19,6 +20,10 @@ module Projects
 
         private
 
+        def valid_payload_size?
+          Gitlab::Utils::DeepSize.new(params).valid?
+        end
+
         def incident_management_available?
           project.feature_available?(:incident_management)
         end

ee/changelogs/unreleased/limit-input-size-for-prometheus-alert-payload.yml

+---
+title: Limit input size for Prometheus alert JSON payload
+merge_request: 19940
+author:
+type: changed

ee/spec/services/projects/prometheus/alerts/notify_service_spec.rb

@@ -338,6 +338,24 @@ describe Projects::Prometheus::Alerts::NotifyService do
 
       it_behaves_like 'no notifications'
     end
+
+    context 'when the payload is too big' do
+      let(:payload) { { 'the-payload-is-too-big' => true } }
+      let(:deep_size_object) { instance_double(Gitlab::Utils::DeepSize, valid?: false) }
+
+      before do
+        allow(Gitlab::Utils::DeepSize).to receive(:new).and_return(deep_size_object)
+      end
+
+      it_behaves_like 'no notifications'
+
+      it 'does not process issues' do
+        expect(IncidentManagement::ProcessPrometheusAlertWorker)
+          .not_to receive(:perform_async)
+
+        subject
+      end
+    end
   end
 
   private