fix: harden auth, SSRF, query engine, and cookie security

apps/monitor/src/query.rs

@@ -218,7 +218,11 @@ fn eval_op(op: &str, field_val: &Value, val: &Value, response: &Response) -> Res
         }
         "$regex" => {
             let pattern = val.as_str().unwrap_or("");
-            let re = Regex::new(pattern).unwrap_or_else(|_| Regex::new("$^").unwrap());
+            if pattern.len() > 200 { return Ok(false); }
+            let re = match Regex::new(pattern) {
+                Ok(r) => r,
+                Err(_) => return Ok(false),
+            };
             field_val.as_str().map(|s| re.is_match(s)).unwrap_or(false)
         }
         "$exists" => {

apps/monitor/src/runner.rs

@@ -118,7 +118,19 @@ async fn run_check(client: &reqwest::Client, monitor: &Monitor, scheduled_at: Op
                 .filter_map(|(k, v)| Some((k.to_string(), v.to_str().ok()?.to_string())))
                 .collect();
 
-            let body = resp.text().await.unwrap_or_default();
+            // Limit response body to 10MB to prevent OOM from malicious targets
+            const MAX_BODY_BYTES: usize = 10 * 1024 * 1024;
+            let body = {
+                let content_len = resp.content_length().unwrap_or(0) as usize;
+                if content_len > MAX_BODY_BYTES {
+                    // Skip reading body entirely if Content-Length exceeds limit
+                    format!("[body truncated: Content-Length {} exceeds 10MB limit]", content_len)
+                } else {
+                    let bytes = resp.bytes().await.unwrap_or_default();
+                    let truncated = &bytes[..bytes.len().min(MAX_BODY_BYTES)];
+                    String::from_utf8_lossy(truncated).into_owned()
+                }
+            };
 
             // Evaluate query if present
             let (up, query_error) = if let Some(q) = &monitor.query {