fix(local-idp): prevent oidc token exchange timeout

infra/local-prod/idp/mock_idp.py

@@ -3,9 +3,10 @@ import json
 import hmac
 import html
 import os
+import socket
 import time
 import uuid
-from http.server import BaseHTTPRequestHandler, HTTPServer
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from urllib.parse import parse_qs, urlencode, urlparse
 
 import jwt
@@ -178,8 +179,20 @@ class Handler(BaseHTTPRequestHandler):
         if urlparse(self.path).path != "/token":
             self.send_json(404, {"error": "not_found"})
             return
-        size = int(self.headers.get("Content-Length", "0"))
-        raw = self.rfile.read(size) or b"{}"
+        try:
+            size = int(self.headers.get("Content-Length", "0"))
+        except ValueError:
+            self.send_json(400, {"error": "invalid_content_length"})
+            return
+        if size < 0 or size > 65536:
+            self.send_json(413, {"error": "request_too_large"})
+            return
+        self.connection.settimeout(5)
+        try:
+            raw = self.rfile.read(size) or b"{}"
+        except (TimeoutError, socket.timeout):
+            self.send_json(408, {"error": "request_timeout"})
+            return
         ctype = self.headers.get("Content-Type", "")
         if "application/json" in ctype:
             supplied_token = self.headers.get("X-CASAN-Approval-Signer-Token", "")
@@ -229,4 +242,6 @@ class Handler(BaseHTTPRequestHandler):
 
 
 if __name__ == "__main__":
-    HTTPServer(("0.0.0.0", PORT), Handler).serve_forever()
+    server = ThreadingHTTPServer(("0.0.0.0", PORT), Handler)
+    server.daemon_threads = True
+    server.serve_forever()