fix(backend): cut request log fields to the log bound (closes #60)

The request log wrote the URL, User-Agent, Referer and other
request-supplied strings with no length limit, and the server accepts
headers up to 1 MiB, so one request could put about 1 MiB per field
into a log line. Every string the request log takes from the request,
including the request ID chi copies from X-Request-Id, is now cut to
the 128-byte bound the report handler already used. That bound and
its helper moved from the handlers package to the logger package so
both use the one copy.

Model: opus-5-5

backend/internal/handlers/report.go

@@ -5,14 +5,10 @@ import (
 	"errors"
 	"net/http"
 
+	"sneak.berlin/go/netwatch/internal/logger"
 	"sneak.berlin/go/netwatch/internal/reportbuf"
 )
 
-// maxLoggedFieldBytes bounds untrusted text (string fields,
-// decode error text) before it is logged, so a caller cannot
-// inflate log volume with an oversized value.
-const maxLoggedFieldBytes = 128
-
 type reportSample struct {
 	T       int64   `json:"t"`
 	Latency *int    `json:"latency"`
@@ -83,7 +79,7 @@ func (s *Handlers) decodeErrorStatus(err error) int {
 	// The decoder's error text can quote request bytes (a whole
 	// oversized number, for example), so it is bounded too.
 	s.log.Error("failed to decode report",
-		"error", boundedForLog(err.Error()),
+		"error", logger.BoundedForLog(err.Error()),
 	)
 
 	return http.StatusBadRequest
@@ -115,20 +111,10 @@ func (s *Handlers) logReportReceived(rpt report) {
 	}
 
 	s.log.Info("report received",
-		"client_id", boundedForLog(rpt.ClientID),
-		"timestamp", boundedForLog(rpt.Timestamp),
+		"client_id", logger.BoundedForLog(rpt.ClientID),
+		"timestamp", logger.BoundedForLog(rpt.Timestamp),
 		"host_count", len(rpt.Hosts),
 		"total_samples", totalSamples,
 		"geo_bytes", len(rpt.Geo),
 	)
 }
-
-// boundedForLog truncates an untrusted string to a fixed byte
-// bound so an attacker-controlled field cannot dominate the log.
-func boundedForLog(s string) string {
-	if len(s) > maxLoggedFieldBytes {
-		return s[:maxLoggedFieldBytes]
-	}
-
-	return s
-}