From 09a4bf829dc3c9106fe7204c096f27381dc500d2 Mon Sep 17 00:00:00 2001
From: xuans <likb_blue@163.com>
Date: Sun, 30 Aug 2026 20:00:26 +0800
Subject: [PATCH] =?UTF-8?q?=E9=99=90=E5=88=B6=E7=AE=A1=E7=90=86=E6=8E=A5?=
 =?UTF-8?q?=E5=8F=A3=E8=AF=B7=E6=B1=82=E4=BD=93=E5=A4=A7=E5=B0=8F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/internal/httpapi/middleware.go   | 8 ++++++++
 backend/internal/httpapi/server.go       | 5 +++++
 backend/internal/httpapi/settings_api.go | 1 +
 backend/internal/httpapi/users_api.go    | 2 ++
 4 files changed, 16 insertions(+)

diff --git a/backend/internal/httpapi/middleware.go b/backend/internal/httpapi/middleware.go
index ab87f29..6d2e28c 100644
--- a/backend/internal/httpapi/middleware.go
+++ b/backend/internal/httpapi/middleware.go
@@ -14,6 +14,7 @@ import (
 )
 
 const requestIDHeader = "X-Scert-Request-ID"
+const jsonRequestBodyLimit = 64 * 1024
 
 func (s *Server) requestMiddleware() gin.HandlerFunc {
 	return func(c *gin.Context) {
@@ -92,6 +93,13 @@ func (s *Server) sameOriginForAPI(request *http.Request) bool {
 	return strings.EqualFold(parsed.Host, request.Host) && strings.EqualFold(parsed.Scheme, requestScheme)
 }
 
+func limitJSONBody(c *gin.Context) {
+	if c == nil || c.Request == nil || c.Request.Body == nil {
+		return
+	}
+	c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, jsonRequestBodyLimit)
+}
+
 func requestIDFromContext(c *gin.Context) string {
 	value, exists := c.Get("request_id")
 	if !exists {
diff --git a/backend/internal/httpapi/server.go b/backend/internal/httpapi/server.go
index 2ffc642..d30d71b 100644
--- a/backend/internal/httpapi/server.go
+++ b/backend/internal/httpapi/server.go
@@ -332,6 +332,7 @@ func (s *Server) listDomains(c *gin.Context) {
 }
 
 func (s *Server) createDomain(c *gin.Context) {
+	limitJSONBody(c)
 	var request domainRequest
 	if err := c.ShouldBindJSON(&request); err != nil {
 		s.writeError(c, http.StatusBadRequest, "请求参数无效", err)
@@ -354,6 +355,7 @@ func (s *Server) createDomain(c *gin.Context) {
 }
 
 func (s *Server) updateDomain(c *gin.Context) {
+	limitJSONBody(c)
 	var request domainRequest
 	if err := c.ShouldBindJSON(&request); err != nil {
 		s.writeError(c, http.StatusBadRequest, "请求参数无效", err)
@@ -464,6 +466,7 @@ func (s *Server) getServer(c *gin.Context) {
 }
 
 func (s *Server) createServer(c *gin.Context) {
+	limitJSONBody(c)
 	if s.servers == nil {
 		s.writeError(c, http.StatusNotImplemented, "服务器管理接口尚未配置", errors.New("服务器仓储未配置"))
 		return
@@ -487,6 +490,7 @@ func (s *Server) createServer(c *gin.Context) {
 }
 
 func (s *Server) updateServer(c *gin.Context) {
+	limitJSONBody(c)
 	if s.servers == nil {
 		s.writeError(c, http.StatusNotImplemented, "服务器管理接口尚未配置", errors.New("服务器仓储未配置"))
 		return
@@ -566,6 +570,7 @@ func (s *Server) listDomainServers(c *gin.Context) {
 }
 
 func (s *Server) replaceDomainServers(c *gin.Context) {
+	limitJSONBody(c)
 	if s.servers == nil {
 		s.writeError(c, http.StatusNotImplemented, "服务器管理接口尚未配置", errors.New("服务器仓储未配置"))
 		return
diff --git a/backend/internal/httpapi/settings_api.go b/backend/internal/httpapi/settings_api.go
index a83ad2b..7586ad0 100644
--- a/backend/internal/httpapi/settings_api.go
+++ b/backend/internal/httpapi/settings_api.go
@@ -150,6 +150,7 @@ func (s *Server) getSettings(c *gin.Context) {
 }
 
 func (s *Server) updateSettings(c *gin.Context) {
+	limitJSONBody(c)
 	if strings.TrimSpace(s.configPath) == "" {
 		s.writeError(c, http.StatusInternalServerError, "配置文件路径未配置", errors.New("配置文件路径为空"))
 		return
diff --git a/backend/internal/httpapi/users_api.go b/backend/internal/httpapi/users_api.go
index b1efc52..14073e3 100644
--- a/backend/internal/httpapi/users_api.go
+++ b/backend/internal/httpapi/users_api.go
@@ -79,6 +79,7 @@ func (s *Server) getUser(c *gin.Context) {
 }
 
 func (s *Server) createUser(c *gin.Context) {
+	limitJSONBody(c)
 	if s.users == nil {
 		s.writeError(c, http.StatusNotImplemented, "用户管理接口尚未配置", errors.New("用户仓储未配置"))
 		return
@@ -102,6 +103,7 @@ func (s *Server) createUser(c *gin.Context) {
 }
 
 func (s *Server) updateUser(c *gin.Context) {
+	limitJSONBody(c)
 	if s.users == nil {
 		s.writeError(c, http.StatusNotImplemented, "用户管理接口尚未配置", errors.New("用户仓储未配置"))
 		return