gh-christianlouis-docuelevate

gitea-admin/gh-christianlouis-docuelevate

Files

T

copilot-swe-agent[bot] ca27a0b687 feat(security): add request size limits to API endpoints

- Add RequestSizeLimitMiddleware that checks Content-Length header
  before request body is read: non-multipart requests capped at
  MAX_REQUEST_BODY_SIZE (default 1 MB), multipart uploads capped at
  MAX_UPLOAD_SIZE (default 1 GB). Returns HTTP 413 on violation.
- Register middleware in app/main.py
- Add max_request_body_size setting to app/config.py
- Fix ui_upload in files.py to check Content-Length early and read
  in 64 KB chunks (bounded memory usage), removing the post-write
  os.path.getsize check
- Document MAX_REQUEST_BODY_SIZE in .env.demo and ConfigurationGuide.md
- Mark SECURITY_AUDIT.md item #4 as resolved
- Add 9 tests in test_request_size_limit.py
- Update test_upload_file_too_large to use patch.object instead of
  the now-unused os.path.getsize mock

Closes #173

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

2026-02-22 14:41:04 +00:00

__init__.py

feat(security): add configurable security headers middleware

2026-02-10 14:05:19 +00:00

audit_log.py

style: apply ruff auto-fix

2026-02-22 14:24:27 +00:00

rate_limit_decorators.py

style: fix code formatting with black, isort, and flake8

2026-02-12 03:21:41 +00:00

rate_limit.py

style: fix code formatting with black, isort, and flake8