Fixes#68 (the parts not covered by #60/expires_in).
Server-side body cap: http.MaxBytesReader middleware caps request bodies at the admin-tunable content cap + 4KiB (floored at 64KiB). Oversized bodies get a clear 413 request body too large and are never fully decoded into memory.
Content cap: per-field check retained (413 with content exceeds max N bytes); whitespace-only content still 400.
burn_after_reads: negative values rejected 400 (burn_after_reads must be a positive number); 0 still means default single read.
limit=0: explicitly maps to the default page size (25 public / 50 mine), matching the pre-existing <=0 clamp. Shared parseLimit helper also handles non-numeric and >max values.
offset: negative or non-numeric values clamped to 0 (previously passed through unchecked).
expires_at/expires_in validation is intentionally out of scope here (covered by #60).
Fixes #68 (the parts not covered by #60/expires_in).
- **Server-side body cap**: `http.MaxBytesReader` middleware caps request bodies at the admin-tunable content cap + 4KiB (floored at 64KiB). Oversized bodies get a clear `413 request body too large` and are never fully decoded into memory.
- **Content cap**: per-field check retained (413 with `content exceeds max N bytes`); whitespace-only content still 400.
- **burn_after_reads**: negative values rejected 400 (`burn_after_reads must be a positive number`); 0 still means default single read.
- **limit=0**: explicitly maps to the default page size (25 public / 50 mine), matching the pre-existing `<=0` clamp. Shared `parseLimit` helper also handles non-numeric and >max values.
- **offset**: negative or non-numeric values clamped to 0 (previously passed through unchecked).
- Regression tests: `internal/api/issue68_validation_test.go` (7 tests).
`expires_at`/`expires_in` validation is intentionally out of scope here (covered by #60).
- enforce server-side body cap via http.MaxBytesReader: oversized JSON
bodies are rejected with 413 instead of being fully decoded first
- negative burn_after_reads rejected with 400 (zero still = default 1)
- limit=0 explicitly maps to default page size; shared parseLimit clamp
for /api/public and /api/mine (huge/non-numeric values too)
- negative/non-numeric offset clamped to 0 via parseOffset (was
pass-through)
- regression tests in issue68_validation_test.go
expires_at/expires_in validation intentionally excluded: covered by #60.
poslop
merged commit 91dbf6f344 into main2026-09-09 14:26:20 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Fixes #68 (the parts not covered by #60/expires_in).
http.MaxBytesReadermiddleware caps request bodies at the admin-tunable content cap + 4KiB (floored at 64KiB). Oversized bodies get a clear413 request body too largeand are never fully decoded into memory.content exceeds max N bytes); whitespace-only content still 400.burn_after_reads must be a positive number); 0 still means default single read.<=0clamp. SharedparseLimithelper also handles non-numeric and >max values.internal/api/issue68_validation_test.go(7 tests).expires_at/expires_invalidation is intentionally out of scope here (covered by #60).