restrict paste metadata dimensions

internal/maps/map_utils.go

@@ -0,0 +1,24 @@
+package maps
+
+func ExceedsDimensions(src map[string]any, width, depth int) bool {
+	if width < 0 || depth < 1 || len(src) > width {
+		return true
+	}
+
+	for _, value := range src {
+		childMap, ok := value.(map[string]any)
+		if !ok {
+			continue
+		}
+
+		if depth == 1 {
+			return true
+		}
+
+		if ExceedsDimensions(childMap, width, depth-1) {
+			return true
+		}
+	}
+
+	return false
+}

internal/static/static.go

@@ -0,0 +1,6 @@
+package static
+
+var (
+	MaxMetadataWidth = 10
+	MaxMetadataDepth = 5
+)

internal/web/v2_end_create_paste.go

@@ -2,8 +2,11 @@ package web
 
 import (
 	"encoding/json"
+	"fmt"
+	"github.com/lus/pasty/internal/maps"
 	"github.com/lus/pasty/internal/pastes"
 	"github.com/lus/pasty/internal/randx"
+	"github.com/lus/pasty/internal/static"
 	"io"
 	"net/http"
 	"time"
@@ -34,6 +37,10 @@ func (server *Server) v2EndpointCreatePaste(writer http.ResponseWriter, request
 		writeString(writer, http.StatusBadRequest, "too large paste content")
 		return
 	}
+	if payload.Metadata != nil && maps.ExceedsDimensions(payload.Metadata, static.MaxMetadataWidth, static.MaxMetadataDepth) {
+		writeString(writer, http.StatusBadRequest, fmt.Sprintf("metadata exceeds maximum dimensions (max. width: %d; max. depth: %d)", static.MaxMetadataWidth, static.MaxMetadataDepth))
+		return
+	}
 
 	id, err := pastes.GenerateID(request.Context(), server.Storage.Pastes(), server.PasteIDCharset, server.PasteIDLength)
 	if err != nil {

internal/web/v2_end_modify_paste.go

@@ -2,7 +2,10 @@ package web
 
 import (
 	"encoding/json"
+	"fmt"
+	"github.com/lus/pasty/internal/maps"
 	"github.com/lus/pasty/internal/pastes"
+	"github.com/lus/pasty/internal/static"
 	"io"
 	"net/http"
 )
@@ -38,6 +41,10 @@ func (server *Server) v2EndpointModifyPaste(writer http.ResponseWriter, request
 		writeString(writer, http.StatusBadRequest, "too large paste content")
 		return
 	}
+	if payload.Metadata != nil && maps.ExceedsDimensions(payload.Metadata, static.MaxMetadataWidth, static.MaxMetadataDepth) {
+		writeString(writer, http.StatusBadRequest, fmt.Sprintf("metadata exceeds maximum dimensions (max. width: %d; max. depth: %d)", static.MaxMetadataWidth, static.MaxMetadataDepth))
+		return
+	}
 
 	// Modify the paste itself
 	if payload.Content != nil {