api: xmlDecoder should honor contentLength. (#2226)

This is needed so that we avoid reading large amounts
of data from compromised clients.

utils.go

@@ -24,8 +24,14 @@ import (
 )
 
 // xmlDecoder provide decoded value in xml.
-func xmlDecoder(body io.Reader, v interface{}) error {
-	d := xml.NewDecoder(body)
+func xmlDecoder(body io.Reader, v interface{}, size int64) error {
+	var lbody io.Reader
+	if size > 0 {
+		lbody = io.LimitReader(body, size)
+	} else {
+		lbody = body
+	}
+	d := xml.NewDecoder(lbody)
 	return d.Decode(v)
 }