Refuse a size whose computed side exceeds the maximum (closes #241)

A side given as 0 is computed from the source's proportions, and
nothing held it to 8192: 0x8192 of a 3000x600 source was resized to
40960x8192 and encoded. Process now refuses such a size with
ErrOutputTooLarge once it knows the source's dimensions, before the
resize and the encode, and both image routes answer it 400 with the
JSON error body. It is a processing error, not a failed fetch, so it
is never negative-cached. imgcache.MaxDimension is now
imageprocessor.MaxOutputDimension, so the request limit and the output
limit are one value. README.md says it under Routes and Encrypted URLs.

Model: opus-5-5

internal/handlers/image.go

@@ -255,6 +255,14 @@ func (s *Handlers) respondImageError(
 		return
 	}
 
+	if errors.Is(err, imageprocessor.ErrOutputTooLarge) {
+		s.respondError(w, fmt.Sprintf("size too large for the source: the side "+
+			"computed from its proportions is above %d",
+			imageprocessor.MaxOutputDimension), http.StatusBadRequest)
+
+		return
+	}
+
 	s.respondError(w, "internal error", http.StatusInternalServerError)
 }
 

internal/handlers/imageenc.go

@@ -165,6 +165,10 @@ func (s *Handlers) handleImageError(w http.ResponseWriter, err error) {
 		errors.Is(err, imageprocessor.ErrUnsupportedInputFormat):
 		s.respondError(w, "unsupported source format",
 			http.StatusUnsupportedMediaType)
+	case errors.Is(err, imageprocessor.ErrOutputTooLarge):
+		s.respondError(w, fmt.Sprintf("size too large for the source: the side "+
+			"computed from its proportions is above %d",
+			imageprocessor.MaxOutputDimension), http.StatusBadRequest)
 	default:
 		s.log.Error("image request failed", "error", err)
 		s.respondError(w, "internal error", http.StatusInternalServerError)

internal/imageprocessor/imageprocessor.go

@@ -133,6 +133,14 @@ var ErrInputTooLarge = errors.New("input image dimensions exceed maximum")
 // configured byte limit.
 var ErrInputDataTooLarge = errors.New("input data exceeds maximum allowed size")
 
+// MaxOutputDimension is the maximum width or height of an output image, and
+// so of a requested size (imgcache.MaxDimension).
+const MaxOutputDimension = 8192
+
+// ErrOutputTooLarge is returned when a size with one side 0 would give that
+// side, computed from the input's proportions, more than MaxOutputDimension.
+var ErrOutputTooLarge = errors.New("output image dimensions exceed maximum")
+
 // ErrUnsupportedOutputFormat is returned when the requested output format is
 // not supported.
 var ErrUnsupportedOutputFormat = errors.New("unsupported output format")
@@ -262,6 +270,13 @@ func (p *ImageProcessor) Process(
 	// Determine target dimensions
 	targetWidth, targetHeight := targetDimensions(req.Size, origWidth, origHeight)
 
+	// A side given as 0 is computed from the input's proportions, so it can
+	// come out above MaxOutputDimension; refuse it before resizing
+	if targetWidth > MaxOutputDimension || targetHeight > MaxOutputDimension {
+		return nil, fmt.Errorf("%w: %dx%d is above %d", ErrOutputTooLarge,
+			targetWidth, targetHeight, MaxOutputDimension)
+	}
+
 	// Resize if needed
 	if targetWidth != origWidth || targetHeight != origHeight {
 		err := p.resize(img, targetWidth, targetHeight, req.FitMode)

internal/imgcache/urlparser.go

@@ -7,6 +7,8 @@ import (
 	"regexp"
 	"strconv"
 	"strings"
+
+	"sneak.berlin/go/pixa/internal/imageprocessor"
 )
 
 // URL parsing errors.
@@ -20,8 +22,9 @@ var (
 	ErrPathTraversal     = errors.New("path traversal detected")
 )
 
-// MaxDimension is the maximum allowed width or height.
-const MaxDimension = 8192
+// MaxDimension is the maximum allowed width or height, the same as the image
+// processor's maximum for an output image.
+const MaxDimension = imageprocessor.MaxOutputDimension
 
 // ValidateDimension checks one requested width or height; name ("width" or
 // "height") appears in the error. 0 means "original size" and is valid.