weichenandCursor
6bc238c665
Centralize template extension, magic-byte, and HTML/script rejection in upload.ValidateTemplate so admin template POST matches project asset hardening. Co-authored-by: Cursor <cursoragent@cursor.com>
41 lines
938 B
Go
41 lines
938 B
Go
package server
|
|
|
|
import (
|
|
"net/http"
|
|
"strings"
|
|
)
|
|
|
|
const (
|
|
defaultJSONBodyLimit = 4 << 20 // 4 MiB
|
|
defaultUploadBodyLimit = 32 << 20 // 32 MiB
|
|
)
|
|
|
|
func (s *Server) bodyLimitMiddleware(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
if r.Body == nil || r.Method == http.MethodGet || r.Method == http.MethodHead || r.Method == http.MethodOptions {
|
|
next.ServeHTTP(w, r)
|
|
return
|
|
}
|
|
limit := int64(defaultJSONBodyLimit)
|
|
if isUploadPath(r.URL.Path) {
|
|
limit = defaultUploadBodyLimit
|
|
}
|
|
r.Body = http.MaxBytesReader(w, r.Body, limit)
|
|
next.ServeHTTP(w, r)
|
|
})
|
|
}
|
|
|
|
func isUploadPath(path string) bool {
|
|
if strings.HasSuffix(path, "/assets") {
|
|
return true
|
|
}
|
|
return strings.Contains(path, "/admin/templates")
|
|
}
|
|
|
|
func isRequestBodyTooLarge(err error) bool {
|
|
if err == nil {
|
|
return false
|
|
}
|
|
return strings.Contains(err.Error(), "http: request body too large")
|
|
}
|