fix: limit anonymous request body

[seefs001]

⚠️ 提交说明 / PR Notice

Important

• 请提供人工撰写的简洁摘要，避免直接粘贴未经整理的 AI 输出。

📝 变更描述 / Description

(简述：做了什么？为什么这样改能生效？请基于你对代码逻辑的理解来写，避免粘贴未经整理的内容)

对一些接口增加body limit，环境变量 ANONYMOUS_REQUEST_BODY_LIMIT_KB，默认为 512 （512KB）

🚀 变更类型 / Type of change

• 🐛 Bug 修复 (Bug fix) - 请关联对应 Issue，避免将设计取舍、理解偏差或预期不一致直接归类为 bug
• ✨ 新功能 (New feature) - 重大特性建议先通过 Issue 沟通
• ⚡ 性能优化 / 重构 (Refactor)
• 📝 文档更新 (Documentation)

🔗 关联任务 / Related Issue

• Closes # (如有)

✅ 提交前检查项 / Checklist

• 人工确认: 我已亲自整理并撰写此描述，没有直接粘贴未经处理的 AI 输出。
• 非重复提交: 我已搜索现有的 Issues 与 PRs，确认不是重复提交。
• Bug fix 说明: 若此 PR 标记为 Bug fix，我已提交或关联对应 Issue，且不会将设计取舍、预期不一致或理解偏差直接归类为 bug。
• 变更理解: 我已理解这些更改的工作原理及可能影响。
• 范围聚焦: 本 PR 未包含任何与当前任务无关的代码改动。
• 本地验证: 已在本地运行并通过测试或手动验证，维护者可以据此复核结果。
• 安全合规: 代码中无敏感凭据，且符合项目代码规范。

📸 运行证明 / Proof of Work

(请在此粘贴截图、关键日志或测试报告，以证明变更生效)

Summary by CodeRabbit

• New Features
  • Anonymous requests now enforce a configurable maximum body size (default 512 KB) via an environment variable.
  • Oversized anonymous requests are rejected with HTTP 413; malformed reads return HTTP 400.
  • Limit is applied to unauthenticated endpoints such as registration/login flows, webhook callbacks, and payment notification routes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 2aa793bd-24b5-4d34-9528-016e7bfd6014

📥 Commits

Reviewing files that changed from the base of the PR and between e2d647e and 7eefc77.

📒 Files selected for processing (2)

• common/request_body_limit.go
• middleware/request_body_limit.go

🚧 Files skipped from review as they are similar to previous changes (2)

• common/request_body_limit.go
• middleware/request_body_limit.go

---

Walkthrough

Adds a configurable anonymous request-body size limit: new env-backed AnonymousRequestBodyLimitKB, a KB→bytes helper, a Gin middleware that enforces the limit (HTTP 413/400), and wiring into anonymous POST endpoints (registrations, logins, OAuth, webhooks, payment callbacks).

Changes

Anonymous Request Body Limit

Layer / File(s)	Summary
Configuration and limit helper constant/env.go, common/init.go, common/request_body_limit.go	Adds exported AnonymousRequestBodyLimitKB, initializes it from ANONYMOUS_REQUEST_BODY_LIMIT_KB (default 512), and provides GetAnonymousRequestBodyLimitBytes() converting KB to bytes.
Request body limit middleware middleware/request_body_limit.go	Adds AnonymousRequestBodyLimit() middleware that reads up to the configured byte limit, responds HTTP 413 on oversized bodies, HTTP 400 on read errors, and replaces c.Request.Body with a buffered reader for handlers.
Router integration router/api-router.go	Applies the middleware to anonymous POST endpoints under /api (e.g., /setup, /user/register, /user/login, password reset, OAuth binding POSTs, webhook callbacks, and payment notification POSTs).

Sequence Diagram

sequenceDiagram
  participant Client
  participant AnonymousRequestBodyLimit
  participant Handler
  Client->>AnonymousRequestBodyLimit: POST request with body
  AnonymousRequestBodyLimit->>AnonymousRequestBodyLimit: Read body up to limit + 1
  alt Body exceeds limit
    AnonymousRequestBodyLimit-->>Client: HTTP 413 Payload Too Large
  else Body within limit
    AnonymousRequestBodyLimit->>Handler: Pass request with buffered body
    Handler-->>Client: Response
  else Read error
    AnonymousRequestBodyLimit-->>Client: HTTP 400 Bad Request
  end

Loading

Possibly related PRs

• QuantumNous/new-api#2452: Related request-body limiting helpers referenced by this middleware.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 I nibble bytes with tidy care,
KB to bytes, a guarded snare,
POSTs now checked at the burrow gate,
413 keeps payloads straight,
A small, safe hop—no data scare. 🥕

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix: limit anonymous request body' accurately summarizes the main change—adding request body size limits for anonymous endpoints via a new environment variable and middleware.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

middleware/request_body_limit.go (1)

19-29: ⚡ Quick win

Short-circuit obvious oversize requests before reading the body.

When Content-Length is already greater than maxBytes, we can return 413 immediately instead of reading and buffering maxBytes+1 bytes first. That avoids unnecessary I/O on the exact path this middleware is protecting.

Proposed change

 		originalBody := c.Request.Body
 		maxBytes := common.GetAnonymousRequestBodyLimitBytes()
+		if c.Request.ContentLength > maxBytes {
+			_ = originalBody.Close()
+			c.AbortWithStatus(http.StatusRequestEntityTooLarge)
+			return
+		}
 		limitedBody, err := readAnonymousRequestBody(originalBody, maxBytes)
 		_ = originalBody.Close()

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@middleware/request_body_limit.go` around lines 19 - 29, The middleware
currently reads and buffers the request body even when Content-Length already
exceeds maxBytes; modify the handler (around where originalBody :=
c.Request.Body and maxBytes := common.GetAnonymousRequestBodyLimitBytes() are
used) to first check c.Request.ContentLength (and fall back to parsing the
"Content-Length" header if needed) and if that length > maxBytes call
c.AbortWithStatus(http.StatusRequestEntityTooLarge) and return without calling
readAnonymousRequestBody or reading the body; preserve the existing error-path
behavior that uses common.IsRequestBodyTooLargeError and ensure the originalBody
is not consumed/closed when you early-return.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@middleware/request_body_limit.go`:
- Around line 19-29: The middleware currently reads and buffers the request body
even when Content-Length already exceeds maxBytes; modify the handler (around
where originalBody := c.Request.Body and maxBytes :=
common.GetAnonymousRequestBodyLimitBytes() are used) to first check
c.Request.ContentLength (and fall back to parsing the "Content-Length" header if
needed) and if that length > maxBytes call
c.AbortWithStatus(http.StatusRequestEntityTooLarge) and return without calling
readAnonymousRequestBody or reading the body; preserve the existing error-path
behavior that uses common.IsRequestBodyTooLargeError and ensure the originalBody
is not consumed/closed when you early-return.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 8f8bed39-525d-4379-8f2a-43584a6231c0

📥 Commits

Reviewing files that changed from the base of the PR and between 0ff9c35 and e2d647e.

📒 Files selected for processing (5)

• common/init.go
• common/request_body_limit.go
• constant/env.go
• middleware/request_body_limit.go
• router/api-router.go