Enforce longpoll batch size

This is additional hardening against
GHSA-628h-q48j-jr6q.

It enforces a maximum of 100 entries per longpoll request.
The client already limits this since 1.8.6. For anyone updating, where many
longpoll events are expected on a single request (very unlikely), update to 1.8.6
or 1.8.7 first.

Author: SteffenDE

lib/phoenix/transports/long_poll.ex

@@ -5,8 +5,7 @@ defmodule Phoenix.Transports.LongPoll do
   # The maximum is 10MB but read_body will cap the whole request at ~8MB,
   # so this acts as a secondary protection mechanism.
   @max_base64_size 10_000_000
-  # TODO: enforce batch size on the server in the next release
-  # @max_poll_batch_size 100
+  @max_poll_batch_size 100
   @connect_info_opts [:check_csrf]
 
   import Plug.Conn
@@ -87,7 +86,7 @@ defmodule Phoenix.Transports.LongPoll do
             ["application/x-ndjson"] ->
               body
               |> String.splitter(["\n", "\r\n"])
-              # |> Stream.take(@max_poll_batch_size)
+              |> Stream.take(@max_poll_batch_size)
               |> Enum.find_value(fn part ->
                 msg =
                   case part do

test/phoenix/integration/long_poll_channels_test.exs

@@ -642,6 +642,36 @@ defmodule Phoenix.Integration.LongPollChannelsTest do
         assert resp.status == 200
         assert resp.body["status"] == 408
       end
+
+      test "ignores ndjson batch entries after the first 100", %{topic: topic} do
+        vsn = "2.0.0"
+        join_ref = "1"
+        session = join("/ws", topic, vsn, join_ref)
+        Phoenix.PubSub.subscribe(__MODULE__, topic)
+
+        messages =
+          for n <- 1..101 do
+            %{
+              "topic" => topic,
+              "event" => "new_msg",
+              "ref" => to_string(n + 1),
+              "join_ref" => join_ref,
+              "payload" => %{"body" => "msg#{n}"}
+            }
+          end
+
+        resp = poll(:post, "/ws", vsn, session, messages)
+        assert resp.body["status"] == 200
+
+        new_msg_bodies =
+          for _ <- 1..100 do
+            assert_receive %Broadcast{event: "new_msg", payload: %{"body" => body}}
+            body
+          end
+
+        assert new_msg_bodies == for(n <- 1..100, do: "msg#{n}")
+        refute_receive %Broadcast{event: "new_msg", payload: %{"body" => "msg101"}}
+      end
     end
 
     for {serializer, vsn, join_ref} <- [