Security: Enforce request-body and credential-size limits before JSON parsing and password verification

[fvent01]

Finding

The Perl JSON middleware reads the full request body with $req->content and decodes it without an application-level size limit. Login validation only checks that the identifier and password are non-empty, while registration and note-size checks happen after the entire JSON body is already buffered and decoded.

Risk

An unauthenticated client that can reach the API through the PHP proxy—or directly after a deployment mistake—can send very large JSON bodies, identifiers, or passwords. This can consume worker memory and CPU, tie up the small worker pool, increase log/database growth, and create a straightforward denial-of-service condition. Oversized passwords also reach the password verification function.

Evidence

• Middleware::JSON::parse_json_body() calls $req->content with no content-length or byte cap.
• validate_login() imposes no maximum length or character constraints on the identifier/password.
• Note and registration limits are applied only after body buffering and JSON decoding.
• The default launcher may run with only two workers.

Recommended remediation

• Reject requests above endpoint-specific byte limits before reading or decoding the body.
• Add a global PSGI request-body cap and smaller limits for authentication endpoints.
• Validate Content-Type: application/json for JSON endpoints.
• Add maximum lengths for login identifiers and passwords before database lookup or password verification.
• Configure reverse-proxy/web-server body limits as defense in depth.
• Return 413 Payload Too Large for oversized bodies.
• Add rate limits for registration and other unauthenticated endpoints.

Acceptance criteria

• Oversized requests are rejected before full buffering/decoding.
• Login identifiers and passwords have documented maximum lengths.
• JSON endpoints reject unsupported content types.
• Large-body attacks cannot monopolize all API workers.
• Tests cover oversized JSON, huge credentials, malformed content length, and boundary-size valid requests.

Priority

P1 — unauthenticated denial-of-service hardening.