xuans/Scert
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

限制管理接口请求体大小

Browse Source
This commit is contained in:
xuans 2026-08-30 20:00:26 +08:00
parent 5497b72e40
commit 09a4bf829d
4 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
backend/internal/httpapi/middleware.go
View File

@ -14,6 +14,7 @@ import (
)
const requestIDHeader = "X-Scert-Request-ID"
const jsonRequestBodyLimit = 64 * 1024
func (s *Server) requestMiddleware() gin.HandlerFunc {
return func(c *gin.Context) {
@ -92,6 +93,13 @@ func (s *Server) sameOriginForAPI(request *http.Request) bool {
return strings.EqualFold(parsed.Host, request.Host) && strings.EqualFold(parsed.Scheme, requestScheme)
}
func limitJSONBody(c *gin.Context) {
if c == nil || c.Request == nil || c.Request.Body == nil {
return
}
c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, jsonRequestBodyLimit)
}
func requestIDFromContext(c *gin.Context) string {
value, exists := c.Get("request_id")
if !exists {

5
backend/internal/httpapi/server.go
View File

@ -332,6 +332,7 @@ func (s *Server) listDomains(c *gin.Context) {
}
func (s *Server) createDomain(c *gin.Context) {
limitJSONBody(c)
var request domainRequest
if err := c.ShouldBindJSON(&request); err != nil {
s.writeError(c, http.StatusBadRequest, "请求参数无效", err)
@ -354,6 +355,7 @@ func (s *Server) createDomain(c *gin.Context) {
}
func (s *Server) updateDomain(c *gin.Context) {
limitJSONBody(c)
var request domainRequest
if err := c.ShouldBindJSON(&request); err != nil {
s.writeError(c, http.StatusBadRequest, "请求参数无效", err)
@ -464,6 +466,7 @@ func (s *Server) getServer(c *gin.Context) {
}
func (s *Server) createServer(c *gin.Context) {
limitJSONBody(c)
if s.servers == nil {
s.writeError(c, http.StatusNotImplemented, "服务器管理接口尚未配置", errors.New("服务器仓储未配置"))
return
@ -487,6 +490,7 @@ func (s *Server) createServer(c *gin.Context) {
}
func (s *Server) updateServer(c *gin.Context) {
limitJSONBody(c)
if s.servers == nil {
s.writeError(c, http.StatusNotImplemented, "服务器管理接口尚未配置", errors.New("服务器仓储未配置"))
return
@ -566,6 +570,7 @@ func (s *Server) listDomainServers(c *gin.Context) {
}
func (s *Server) replaceDomainServers(c *gin.Context) {
limitJSONBody(c)
if s.servers == nil {
s.writeError(c, http.StatusNotImplemented, "服务器管理接口尚未配置", errors.New("服务器仓储未配置"))
return

1
backend/internal/httpapi/settings_api.go
View File

@ -150,6 +150,7 @@ func (s *Server) getSettings(c *gin.Context) {
}
func (s *Server) updateSettings(c *gin.Context) {
limitJSONBody(c)
if strings.TrimSpace(s.configPath) == "" {
s.writeError(c, http.StatusInternalServerError, "配置文件路径未配置", errors.New("配置文件路径为空"))
return

2
backend/internal/httpapi/users_api.go
View File

@ -79,6 +79,7 @@ func (s *Server) getUser(c *gin.Context) {
}
func (s *Server) createUser(c *gin.Context) {
limitJSONBody(c)
if s.users == nil {
s.writeError(c, http.StatusNotImplemented, "用户管理接口尚未配置", errors.New("用户仓储未配置"))
return
@ -102,6 +103,7 @@ func (s *Server) createUser(c *gin.Context) {
}
func (s *Server) updateUser(c *gin.Context) {
limitJSONBody(c)
if s.users == nil {
s.writeError(c, http.StatusNotImplemented, "用户管理接口尚未配置", errors.New("用户仓储未配置"))
return