Commit graph

3 commits

Author SHA1 Message Date
Michael Mayer
073261ce8d Scripts: Compact check-file comment in check-api-request-limits 2026-05-15 17:53:40 +00:00
Michael Mayer
7d39b2d9fe API: Extend check-api-request-limits.sh for ServeHTTP and direct reads
- Flag <name>.ServeHTTP(<writer>, c.Request) calls without a nearby
  LimitRequestBodyBytes so SDK-delegated handlers (MCP today, future
  SDKs tomorrow) are held to the same body-cap contract as BindJSON.
- Also flag direct reads via io.ReadAll, io.LimitReader,
  json.NewDecoder, xml.NewDecoder, and yaml.NewDecoder on c.Request.Body

Signed-off-by: Michael Mayer <michael@photoprism.app>
2026-04-20 13:55:29 +02:00
Michael Mayer
e9a714098d Security: Add API request-limit regression check script
Signed-off-by: Michael Mayer <michael@photoprism.app>
2026-03-08 15:12:32 +01:00