herel/math-tables
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity

fix(api): Add upper bound validation to num_exercises

Browse Source 
The /generate and /generate-operations endpoints accepted num_exercises
without an upper bound, allowing DoS via excessively large values.
Add Field(le=100) to both ExerciseRequest and OperationExerciseRequest
Pydantic models to cap exercises at 100.

Fixes vuln-0001
This commit is contained in:
Rene Luria
2026-07-01 15:07:10 +02:00
parent e4db258bc5
commit cc64d126be
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/main.py
+4 -4
View File
@@ -8,7 +8,7 @@ from typing import List
from fastapi import FastAPI, Request, Form from fastapi import FastAPI, Request, Form
from fastapi.responses import HTMLResponse, RedirectResponse, StreamingResponse from fastapi.responses import HTMLResponse, RedirectResponse, StreamingResponse
from fastapi.templating import Jinja2Templates from fastapi.templating import Jinja2Templates
from pydantic import BaseModel from pydantic import BaseModel, Field
from fpdf import FPDF from fpdf import FPDF
import logging import logging
@@ -68,13 +68,13 @@ class MathExercisesPDF(FPDF):
class ExerciseRequest(BaseModel): class ExerciseRequest(BaseModel):
min_table: int min_table: int
max_table: int max_table: int
num_exercises: int = 15 num_exercises: int = Field(15, ge=1, le=100)
multiplication_only: bool = False multiplication_only: bool = False
max_first_operand: int = 12 # New parameter for the maximum value of the first operand max_first_operand: int = Field(12, ge=1, le=12) # New parameter for the maximum value of the first operand
class OperationExerciseRequest(BaseModel): class OperationExerciseRequest(BaseModel):
num_exercises: int = 20 num_exercises: int = Field(20, ge=1, le=100)
def generate_exercises( def generate_exercises(