mosaic/stack
1
0
Fork 0
Code Issues 14 Pull Requests 1 Actions Packages Projects Releases 2 Wiki Activity

fix(SEC-API-19+20): Validate brain search length and limit params
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful
Details

Browse Source 
- Add @MaxLength(500) to BrainQueryDto.query and BrainQueryDto.search fields
- Create BrainSearchDto with validated q (max 500 chars) and limit (1-100) fields
- Update BrainController.search to use BrainSearchDto instead of raw query params
- Add defensive validation in BrainService.search and BrainService.query methods:
  - Reject search terms exceeding 500 characters with BadRequestException
  - Clamp limit to valid range [1, 100] for defense-in-depth
- Add comprehensive tests for DTO validation and service-level guards
- Update existing controller tests for new search method signature

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Jason Woltje
2026-02-06 13:29:03 -06:00
parent ef1f1eee9d
commit 17cfeb974b
6 changed files with 299 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
apps/api/src/brain/dto/index.ts
View File

@@ -1,5 +1,6 @@
export {
BrainQueryDto,
BrainSearchDto,
TaskFilter,
EventFilter,
ProjectFilter,