Security: NewSession.lineId missing maxLength constraint — unbounded input stored in DB

[LucasMaupin]

Summary

The NewSession schema validates lineId as Type.String({ minLength: 1 }) with no upper length bound. An arbitrarily long lineId can be submitted, stored in the database, and later echoed in error messages and log output.

Location

• src/models.ts — NewSession type definition (lineId: Type.String({ minLength: 1 }))
• Also: SdpAnswer.sdpAnswer field has no maxLength constraint

Details

By contrast, WHIP/WHEP schemas correctly constrain lineId to maxLength: 200. The inconsistency means the POST /api/v1/session endpoint accepts unbounded strings that bypass length-based DoS mitigations.

Note: Existing issue #239 tracks missing maxLength on production/line name fields. This issue covers the session-specific fields which were missed.

Recommendation

Add maxLength constraints:

// In NewSession:
lineId: Type.String({ minLength: 1, maxLength: 200 })

// In SdpAnswer:
sdpAnswer: Type.String({ maxLength: 65536 }) // bound SDP size at schema level

Severity

LOW