From cc64d126beb2eadbb85b05ec14ac525bebb96b04 Mon Sep 17 00:00:00 2001 From: Rene Luria Date: Wed, 1 Jul 2026 15:07:10 +0200 Subject: [PATCH] fix(api): Add upper bound validation to num_exercises The /generate and /generate-operations endpoints accepted num_exercises without an upper bound, allowing DoS via excessively large values. Add Field(le=100) to both ExerciseRequest and OperationExerciseRequest Pydantic models to cap exercises at 100. Fixes vuln-0001 --- app/main.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/app/main.py b/app/main.py index 6d3a66f..d2cb59b 100644 --- a/app/main.py +++ b/app/main.py @@ -8,7 +8,7 @@ from typing import List from fastapi import FastAPI, Request, Form from fastapi.responses import HTMLResponse, RedirectResponse, StreamingResponse from fastapi.templating import Jinja2Templates -from pydantic import BaseModel +from pydantic import BaseModel, Field from fpdf import FPDF import logging @@ -68,13 +68,13 @@ class MathExercisesPDF(FPDF): class ExerciseRequest(BaseModel): min_table: int max_table: int - num_exercises: int = 15 + num_exercises: int = Field(15, ge=1, le=100) multiplication_only: bool = False - max_first_operand: int = 12 # New parameter for the maximum value of the first operand + max_first_operand: int = Field(12, ge=1, le=12) # New parameter for the maximum value of the first operand class OperationExerciseRequest(BaseModel): - num_exercises: int = 20 + num_exercises: int = Field(20, ge=1, le=100) def generate_exercises(