tech/tanabata
1
1
Fork 0
Code Pull Requests Actions Releases Activity

fix(backend): cap upload size to prevent memory exhaustion

Browse Source 
Upload and Replace buffered the entire request body into memory with no
size limit, so a few large uploads could OOM the server. The file
handler now wraps the request body in http.MaxBytesReader and rejects any
file larger than MAX_UPLOAD_BYTES (default 500 MiB) before it is buffered.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Masahiko AMANO
2026-06-10 14:07:34 +03:00
parent f069fccd96
commit fa2acca858
5 changed files with 52 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.example
+3
View File
@@ -27,6 +27,9 @@ DATABASE_URL=postgres://tanabata:password@localhost:5432/tanabata?sslmode=disabl
FILES_PATH=/data/files
THUMBS_CACHE_PATH=/data/thumbs
# Maximum accepted upload size in bytes (default 500 MiB).
MAX_UPLOAD_BYTES=524288000
# ---------------------------------------------------------------------------
# Thumbnails
# ---------------------------------------------------------------------------