fix: limit omnichannel webhook response size (#38944)

Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>
Co-authored-by: Kevin Aleman <kaleman960@gmail.com>
Co-authored-by: Guilherme Gazzo <guilherme@gazzo.xyz>

Author: 4 people

.changeset/tender-papayas-jam.md

@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Limits Omnichannel webhook maximum response size to 10mb.

apps/meteor/app/livechat/server/api/v1/webhooks.ts

@@ -66,6 +66,7 @@ API.v1.addRoute(
 				body: sampleData,
 				// SECURITY: Webhooks can only be configured by users with enough privileges. It's ok to disable this check here.
 				ignoreSsrfValidation: true,
+				size: 10 * 1024 * 1024,
 			} as ExtendedFetchOptions;
 
 			const webhookUrl = settings.get<string>('Livechat_webhookUrl');

apps/meteor/app/livechat/server/lib/webhooks.ts

@@ -29,6 +29,7 @@ export async function sendRequest(
 			timeout,
 			// SECURITY: Webhooks can only be configured by users with enough privileges. It's ok to disable this check here.
 			ignoreSsrfValidation: true,
+			size: 10 * 1024 * 1024,
 		});
 
 		if (result.status === 200) {