Add express.json() body size limit (1MB) to all /api/* routes #887

New issue

Open

opened 2026-04-12 02:03:19 -04:00 by pook · 0 comments

pook commented

2026-04-12 02:03:19 -04:00

Owner

Steps:

Find where express.json() middleware is configured in the app
Add { limit: '1mb' } option: app.use(express.json({ limit: '1mb' }))
If express.json() is called without options, add the limit option
Write test: POST /api/generate with 1.1MB payload returns HTTP 413 Payload Too Large
Write test: POST /api/generate with 100KB payload is accepted (returns 400 or 200, NOT 413)
Run full test suite

Acceptance: Body size limit of 1MB enforced globally. Oversized payloads get 413. Normal requests unaffected. Tests pass.

Generated by CEO Planner (priority: 3)

The /api/generate endpoint accepts document generation requests but there's no global body size limit. A malicious or buggy client could send multi-GB payloads, consuming server memory and potentially crashing the process. ContractPilot has issue #789 for this; ComplianceBot has no equivalent. Steps: 1. Find where `express.json()` middleware is configured in the app 2. Add `{ limit: '1mb' }` option: `app.use(express.json({ limit: '1mb' }))` 3. If express.json() is called without options, add the limit option 4. Write test: POST /api/generate with 1.1MB payload returns HTTP 413 Payload Too Large 5. Write test: POST /api/generate with 100KB payload is accepted (returns 400 or 200, NOT 413) 6. Run full test suite Acceptance: Body size limit of 1MB enforced globally. Oversized payloads get 413. Normal requests unaffected. Tests pass. --- *Generated by CEO Planner (priority: 3)*

pook added the

agent-task

label

2026-04-12 02:03:19 -04:00

No labels

agent-task

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

pook/compliancebot#887

No description provided.

Rows
Columns