Creating a session, logging in and posting a message wrapped the body in http.MaxBytesReader, then decoded with json.NewDecoder. The decoder stops after the first JSON value, so the limit never saw the rest of the body and trailing bytes were ignored.
All three now call decodeJSON in internal/handlers/handlers.go. It reads the whole limited body and calls json.Unmarshal. A body over MAX_MESSAGE_SIZE, or anything but whitespace after the JSON value, gets 400invalid request body.
TestRequestBodyLimit has one subtest per endpoint. Each sends a small valid value followed by trailing bytes, including one byte past the limit. Each also checks that a value padded with spaces to exactly the limit is still accepted.
What the diff does not show:
The checks that already ran before the body is read still run first. Posting a message without a valid session gets 401, and logging in over the rate limit gets 429, whatever the body size.
The test assumes the default MAX_MESSAGE_SIZE of 4096, because the test server does not set it.
Judgement call: decodeJSON is the name and file CONVENTIONS.md gives this helper. It is a plain function taking the request and destination, because a receiver and a writer would go unused.
Model: opus-5-5
Fixes https://git.eeqj.de/sneak/neoirc/issues/250.
Creating a session, logging in and posting a message wrapped the body in `http.MaxBytesReader`, then decoded with `json.NewDecoder`. The decoder stops after the first JSON value, so the limit never saw the rest of the body and trailing bytes were ignored.
All three now call `decodeJSON` in `internal/handlers/handlers.go`. It reads the whole limited body and calls `json.Unmarshal`. A body over `MAX_MESSAGE_SIZE`, or anything but whitespace after the JSON value, gets `400` `invalid request body`.
`TestRequestBodyLimit` has one subtest per endpoint. Each sends a small valid value followed by trailing bytes, including one byte past the limit. Each also checks that a value padded with spaces to exactly the limit is still accepted.
What the diff does not show:
- The checks that already ran before the body is read still run first. Posting a message without a valid session gets `401`, and logging in over the rate limit gets `429`, whatever the body size.
- The test assumes the default `MAX_MESSAGE_SIZE` of `4096`, because the test server does not set it.
Judgement call: `decodeJSON` is the name and file `CONVENTIONS.md` gives this helper. It is a plain function taking the request and destination, because a receiver and a writer would go unused.
Model: opus-5-5
Creating a session, logging in and posting a message stopped reading
after the first JSON value, so the limit never saw the rest of the
body and trailing bytes were ignored. All three now read the whole
limited body and decode it with json.Unmarshal. A body over the limit,
or anything but whitespace after the value, gets 400 invalid request
body.
Model: opus-5-5
PASS: #253 meets the definition of done of #250 on all three endpoints.
Model: opus-5-5
PASS: https://git.eeqj.de/sneak/neoirc/pulls/253 meets the definition of done of https://git.eeqj.de/sneak/neoirc/issues/250 on all three endpoints.
Model: opus-5-5
clawbot
merged commit c12668226f into next2026-11-03 09:20:43 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Fixes #250.
Creating a session, logging in and posting a message wrapped the body in
http.MaxBytesReader, then decoded withjson.NewDecoder. The decoder stops after the first JSON value, so the limit never saw the rest of the body and trailing bytes were ignored.All three now call
decodeJSONininternal/handlers/handlers.go. It reads the whole limited body and callsjson.Unmarshal. A body overMAX_MESSAGE_SIZE, or anything but whitespace after the JSON value, gets400invalid request body.TestRequestBodyLimithas one subtest per endpoint. Each sends a small valid value followed by trailing bytes, including one byte past the limit. Each also checks that a value padded with spaces to exactly the limit is still accepted.What the diff does not show:
401, and logging in over the rate limit gets429, whatever the body size.MAX_MESSAGE_SIZEof4096, because the test server does not set it.Judgement call:
decodeJSONis the name and fileCONVENTIONS.mdgives this helper. It is a plain function taking the request and destination, because a receiver and a writer would go unused.Model: opus-5-5
PASS: #253 meets the definition of done of #250 on all three endpoints.
Model: opus-5-5