Merge pull request 'fix: input validation gaps (#68)' (#78) from issue-68-input-validation into main

internal/api/server.go

@@ -59,6 +59,7 @@ func (a *apiServer) routes() http.Handler {
 	r := chi.NewRouter()
 	r.Use(middleware.Recoverer)
 	r.Use(middleware.Timeout(30 * time.Second))
+	r.Use(a.limitRequestBody) // #68: hard server-side body cap -> 413
 	r.Use(viewerCookieMiddleware)
 	r.Use(web.SecurityHeaders) // #59: CSP + hardening headers on HTML pages
 
@@ -153,16 +154,22 @@ func (a *apiServer) handleCreatePaste(w http.ResponseWriter, r *http.Request) {
 	}
 	var p store.Paste
 	if err := json.NewDecoder(r.Body).Decode(&p); err != nil {
+		if isBodyTooLarge(err) { // #68: body cut off by MaxBytesReader
+			writeBodyTooLarge(w)
+			return
+		}
 		writeErr(w, 400, "invalid json body")
 		return
 	}
-	if strings.TrimSpace(p.Content) == "" {
-		writeErr(w, 400, "content is required")
+	if status, msg := checkContent(p.Content, s.MaxContentBytes); status != 0 {
+		writeErr(w, status, msg)
 		return
 	}
-	if int64(len(p.Content)) > s.MaxContentBytes { // #40: admin-tunable
-		writeErr(w, 413, fmt.Sprintf("content exceeds max %d bytes", s.MaxContentBytes))
-		return
+	if p.BurnAfterReads != nil { // #68: reject negative read budgets
+		if err := parseBurnAfterReads(*p.BurnAfterReads); err != nil {
+			writeErr(w, 400, err.Error())
+			return
+		}
 	}
 	// #40: admin-configurable default expiry
 	if (p.ExpiresIn == nil || *p.ExpiresIn == "") && s.DefaultExpiry != "" {
@@ -291,11 +298,8 @@ func (a *apiServer) handleListMine(w http.ResponseWriter, r *http.Request) {
 		writeJSON(w, 200, map[string]any{"total": 0, "items": []any{}})
 		return
 	}
-	limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
-	if limit <= 0 || limit > 100 {
-		limit = 50
-	}
-	offset, _ := strconv.Atoi(r.URL.Query().Get("offset"))
+	limit := parseLimit(r, 50, 100)
+	offset := parseOffset(r)
 	rows, total, err := a.store.ListMine(vid, limit, offset)
 	if err != nil {
 		writeErr(w, 500, "db error")
@@ -314,11 +318,8 @@ func (a *apiServer) handleListMine(w http.ResponseWriter, r *http.Request) {
 }
 
 func (a *apiServer) handleListPublic(w http.ResponseWriter, r *http.Request) {
-	limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
-	if limit <= 0 || limit > 100 {
-		limit = 25
-	}
-	offset, _ := strconv.Atoi(r.URL.Query().Get("offset"))
+	limit := parseLimit(r, 25, 100)
+	offset := parseOffset(r)
 	rows, total, err := a.store.ListPublic(limit, offset)
 	if err != nil {
 		writeErr(w, 500, "db error")