fix(terminal): bound websocket input frames

cmd/dashboard/controller/terminal.go

@@ -14,6 +14,11 @@ import (
 	"github.com/nezhahq/nezha/service/singleton"
 )
 
+// Allow the frontend's 512 KiB clipboard payload plus xterm's bracketed-paste
+// control bytes, while keeping the complete tagged message below the 1 MiB
+// IO stream relay buffer.
+const terminalWebSocketInputLimit int64 = 512*1024 + 64
+
 // Create web ssh terminal
 // @Summary Create web ssh terminal
 // @Description Create web ssh terminal
@@ -100,6 +105,7 @@ func terminalStream(c *gin.Context) (any, error) {
 	if err != nil {
 		return nil, newWsError("%v", err)
 	}
+	wsConn.SetReadLimit(terminalWebSocketInputLimit)
 	conn := websocketx.NewConn(wsConn)
 	pingTransport := newWebsocketPingTransport(conn, wsConn.Close)
 	stopPing := startWebsocketPingTicker(c.Request.Context(), time.Second*10, pingTransport)

cmd/dashboard/controller/terminal_input_limit_test.go

@@ -0,0 +1,9 @@
+package controller
+
+import "testing"
+
+func TestTerminalWebSocketInputLimitAllowsBoundedPaste(t *testing.T) {
+	if terminalWebSocketInputLimit != 512*1024+64 {
+		t.Fatalf("terminal WebSocket input limit = %d, want 512 KiB plus control-byte allowance", terminalWebSocketInputLimit)
+	}
+}