Skip to content

feat(guardrails): add payload size guardrails to user input #128

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ayush00git merged 7 commits into from
Aug 18, 2026
Merged

feat(guardrails): add payload size guardrails to user input #128

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
d1f205a
fix: increase signup req/min rate limitm
ayush00git Aug 16, 2026
7bdc4bd
fix: added payload guardrails
ayush00git Aug 16, 2026
e986af6
fix: added payload size guardrails to auth fields
ayush00git Aug 16, 2026
8b6ad9b
Merge branch 'main' into fix/payload-guardrails
ayush00git Aug 18, 2026
349f576
fix: applied to models/ dir
ayush00git Aug 18, 2026
f328e09
fix: applied payload guards to handlers struct
ayush00git Aug 18, 2026
ebb68b3
fix: applied counters to input fields
ayush00git Aug 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 20 additions & 16 deletions app/src/components/CommentBox.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -157,24 +157,28 @@ export function CommentBox({
onChange={(e) => onEditingTextChange?.(e.target.value)}
disabled={isBusy}
rows={2}
maxLength={2000}
className="w-full text-[12.5px] text-zinc-800 bg-white border border-zinc-200 rounded-lg px-3 py-2.5 focus:outline-none focus:ring-4 focus:ring-zinc-800/5 focus:border-zinc-400 transition resize-none"
/>
<div className="mt-2.5 flex justify-end gap-2">
<button
onClick={onCancelEdit}
disabled={isBusy}
className="border border-zinc-200 text-zinc-500 hover:bg-zinc-50 font-semibold text-xs px-3 py-1.5 rounded-lg transition cursor-pointer"
>
Cancel
</button>
<button
onClick={onSaveEdit}
disabled={isBusy || !editingText.trim()}
className="bg-zinc-900 text-white hover:bg-zinc-800 font-semibold text-xs px-4.5 py-1.5 rounded-lg transition disabled:opacity-40 disabled:cursor-not-allowed cursor-pointer flex items-center gap-1.5"
>
{isBusy && <Loader size="xs" color="white" />}
Save
</button>
<div className="mt-2.5 flex items-center justify-between gap-2">
<span className="text-[10px] text-zinc-400 font-medium">{editingText.length}/2000</span>
<div className="flex gap-2">
<button
onClick={onCancelEdit}
disabled={isBusy}
className="border border-zinc-200 text-zinc-500 hover:bg-zinc-50 font-semibold text-xs px-3 py-1.5 rounded-lg transition cursor-pointer"
>
Cancel
</button>
<button
onClick={onSaveEdit}
disabled={isBusy || !editingText.trim()}
className="bg-zinc-900 text-white hover:bg-zinc-800 font-semibold text-xs px-4.5 py-1.5 rounded-lg transition disabled:opacity-40 disabled:cursor-not-allowed cursor-pointer flex items-center gap-1.5"
>
{isBusy && <Loader size="xs" color="white" />}
Save
</button>
</div>
</div>
</div>
) : (
Expand Down
5 changes: 4 additions & 1 deletion app/src/pages/admin/AdminPostView.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -905,13 +905,16 @@ export function AdminPostView() {
? 'Add a comment and select an action below...'
: 'No actions available.'}
rows={3}
maxLength={2000}
className="w-full text-[13px] text-zinc-800 placeholder-zinc-400 bg-transparent px-4 py-3.5 resize-none focus:outline-none disabled:opacity-50 disabled:cursor-not-allowed"
/>

{/* Bottom Toolbar */}
<div className="bg-zinc-50/50 border-t border-zinc-100 px-4 py-3 flex flex-col sm:flex-row sm:items-center justify-between gap-3">
<span className="text-[10px] text-zinc-400 font-bold uppercase tracking-wider">
<span className="text-[10px] text-zinc-400 font-bold uppercase tracking-wider flex items-center gap-2">
Comment &amp; Update Status
<span className="normal-case font-medium tracking-normal text-zinc-300">·</span>
<span className="normal-case font-medium tracking-normal">{commentText.length}/2000</span>
</span>

{/* Action buttons */}
Expand Down
12 changes: 10 additions & 2 deletions app/src/pages/post/CentreHeadPost.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,26 +118,34 @@ export function CentreHeadPost() {
<h2 className="text-xs font-bold uppercase tracking-widest text-[#666666] mb-4">Title & Description</h2>
<div className="space-y-5">
<div>
<label className={labelCls}>Title</label>
<div className="flex items-center justify-between mb-1.5">
<label className="text-sm font-semibold text-[#111111]">Title</label>
<span className="text-[11px] text-[#999999]">{formData.title.length}/50</span>
</div>
<input
type="text"
name="title"
value={formData.title}
onChange={handleChange}
className={inputCls}
placeholder="e.g. Faulty wiring in corridor"
maxLength={50}
required
/>
</div>
<div>
<label className={labelCls}>Description</label>
<div className="flex items-center justify-between mb-1.5">
<label className="text-sm font-semibold text-[#111111]">Description</label>
<span className="text-[11px] text-[#999999]">{formData.description.length}/5000</span>
</div>
<textarea
name="description"
value={formData.description}
onChange={handleChange}
className={`${inputCls} resize-none`}
placeholder="Provide a detailed description including the floor or zone..."
rows={6}
maxLength={5000}
required
/>
</div>
Expand Down
11 changes: 9 additions & 2 deletions app/src/pages/post/FacultyPost.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,7 +124,10 @@ export function FacultyPost() {
</div>

<div className="md:col-span-2">
<label className={labelCls}>Title</label>
<div className="flex items-center justify-between mb-1.5">
<label className="text-sm font-semibold text-[#111111]">Title</label>
<span className="text-[11px] text-[#999999]">{formData.title.length}/50</span>
</div>
<input
type="text"
name="title"
Expand All @@ -142,14 +145,18 @@ export function FacultyPost() {
<div className="border-t border-[#CCCCCC]" />

<div>
<h2 className="text-xs font-bold uppercase tracking-widest text-[#666666] mb-4">Description</h2>
<div className="flex items-center justify-between mb-4">
<h2 className="text-xs font-bold uppercase tracking-widest text-[#666666]">Description</h2>
<span className="text-[11px] text-[#999999]">{formData.description.length}/5000</span>
</div>
<textarea
name="description"
value={formData.description}
onChange={handleChange}
className={`${inputCls} resize-none`}
placeholder="Provide a detailed description of the issue, including the exact location..."
rows={6}
maxLength={5000}
required
/>
</div>
Expand Down
21 changes: 17 additions & 4 deletions app/src/pages/post/PostView.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -353,11 +353,15 @@ export function PostView() {
</div>
{isEditing ? (
<div className="mt-2">
<label className="block text-[10px] font-bold uppercase tracking-wider text-gray-400 mb-1">Title</label>
<div className="flex items-center justify-between mb-1">
<label className="text-[10px] font-bold uppercase tracking-wider text-gray-400">Title</label>
<span className="text-[10px] text-gray-400">{editForm.title.length}/50</span>
</div>
<input
type="text"
value={editForm.title}
onChange={(e) => setEditForm(prev => ({ ...prev, title: e.target.value }))}
maxLength={50}
className="w-full text-base text-gray-800 bg-white border border-gray-300 rounded-lg px-3 py-2 focus:outline-none focus:ring-2 focus:ring-gray-400/40 focus:border-gray-600"
/>
</div>
Expand All @@ -380,12 +384,18 @@ export function PostView() {

{/* Description */}
<div className="space-y-1.5">
<h4 className="text-[10px] font-bold uppercase tracking-wider text-gray-400">Description</h4>
<div className="flex items-center justify-between">
<h4 className="text-[10px] font-bold uppercase tracking-wider text-gray-400">Description</h4>
{isEditing && (
<span className="text-[10px] text-gray-400">{editForm.description.length}/5000</span>
)}
</div>
{isEditing ? (
<textarea
rows={5}
value={editForm.description}
onChange={(e) => setEditForm(prev => ({ ...prev, description: e.target.value }))}
maxLength={5000}
className="w-full text-sm text-gray-800 bg-white border border-gray-300 rounded-lg px-3 py-2 focus:outline-none focus:ring-2 focus:ring-gray-400/40 focus:border-gray-600 resize-none"
/>
) : (
Expand Down Expand Up @@ -593,16 +603,19 @@ export function PostView() {
}}
disabled={commentSubmitting}
rows={3}
maxLength={2000}
placeholder="Add a reply or update..."
className="w-full text-[13px] text-zinc-800 placeholder-zinc-400 bg-transparent px-4 py-3.5 resize-none focus:outline-none disabled:opacity-50"
/>

{/* Bottom Toolbar */}
<div className="bg-zinc-50/50 border-t border-zinc-100 px-3 sm:px-4 py-2.5 flex flex-wrap items-center justify-between gap-2">
<span className="text-[10px] text-zinc-400 font-medium">
<span className="text-[10px] text-zinc-400 font-medium flex items-center gap-2">
Press <kbd className="font-sans font-semibold">Ctrl + Enter</kbd> to send
<span className="text-zinc-300">·</span>
{commentText.length}/2000
</span>

<button
onClick={submitComment}
disabled={commentSubmitting || !commentText.trim()}
Expand Down
12 changes: 10 additions & 2 deletions app/src/pages/post/WardenPost.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,14 +127,18 @@ export function WardenPost() {
</div>

<div className="md:col-span-2">
<label className={labelCls}>Title</label>
<div className="flex items-center justify-between mb-1.5">
<label className="text-sm font-semibold text-[#111111]">Title</label>
<span className="text-[11px] text-[#999999]">{formData.title.length}/50</span>
</div>
<input
type="text"
name="title"
value={formData.title}
onChange={handleChange}
className={inputCls}
placeholder="e.g. Broken door lock in room 204"
maxLength={50}
required
/>
</div>
Expand All @@ -144,14 +148,18 @@ export function WardenPost() {
<div className="border-t border-[#CCCCCC]" />

<div>
<h2 className="text-xs font-bold uppercase tracking-widest text-[#666666] mb-4">Description</h2>
<div className="flex items-center justify-between mb-4">
<h2 className="text-xs font-bold uppercase tracking-widest text-[#666666]">Description</h2>
<span className="text-[11px] text-[#999999]">{formData.description.length}/5000</span>
</div>
<textarea
name="description"
value={formData.description}
onChange={handleChange}
className={`${inputCls} resize-none`}
placeholder="Provide a detailed description of the issue, including the exact location..."
rows={6}
maxLength={5000}
required
/>
</div>
Expand Down
2 changes: 1 addition & 1 deletion handlers/admin_comment.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ type AdminHandler struct {
}

type CommentType struct {
Content string
Content string `binding:"required,max=2000"`
}


Expand Down
4 changes: 2 additions & 2 deletions handlers/admin_status.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,8 +24,8 @@ import (
)

type AdminReview struct {
Review string `json:"Review"`
JeToAssign string `json:"JeToAssign"`
Review string `json:"Review" binding:"required,max=20"`
JeToAssign string `json:"JeToAssign" binding:"omitempty,email,max=255"`
}

// PostStatus
Expand Down
4 changes: 2 additions & 2 deletions handlers/centrehead_auth.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,8 @@ import (
)

type CentreheadProfileEditType struct {
Building string `json:"building"`
PhoneNumber string `json:"phone_number"`
Building string `json:"building" binding:"omitempty,min=7,max=75"`
PhoneNumber string `json:"phone_number" binding:"omitempty,min=10,max=15"`
}


Expand Down
10 changes: 5 additions & 5 deletions handlers/centrehead_post.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,16 +18,16 @@ import (

// CentreheadPostEditType
type CentreheadPostEditType struct {
Title string `json:"title"`
Description string `json:"description"`
Title string `json:"title" binding:"omitempty,max=50"`
Description string `json:"description" binding:"omitempty,max=5000"`
UpdatedAt time.Time `json:"updated_at"`
}

// CentreheadPostType
type CentreheadPostType struct {
Title string `json:"title"`
Description string `json:"description"`
TypeOfPost string `json:"type_of_post"`
Title string `json:"title" binding:"required,max=50"`
Description string `json:"description" binding:"required,max=5000"`
TypeOfPost string `json:"type_of_post" binding:"required,max=20"`
}

// CentreheadPost registers the post of centre-head members.
Expand Down
16 changes: 8 additions & 8 deletions handlers/faculty_auth.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,20 +19,20 @@ type AuthHandler struct {
}

type ResetPassword struct {
Password string `json:"password" binding:"required"`
Password string `json:"password" binding:"required,max=72"`
}

type ForgetPassword struct {
Email string `json:"email" binding:"required"`
Email string `json:"email" binding:"required,email,max=255"`
}

type FacultyProfileEditType struct {
Name string `json:"name"`
Department string `json:"department"`
HouseNumber string `json:"house_number"`
Block string `json:"block"`
Type string `json:"type"`
PhoneNumber string `json:"phone_number"`
Name string `json:"name" binding:"omitempty,min=3,max=50"`
Department string `json:"department" binding:"omitempty,min=5,max=50"`
HouseNumber string `json:"house_number" binding:"omitempty,max=4"`
Block string `json:"block" binding:"omitempty,max=1"`
Type string `json:"type" binding:"omitempty,max=1"`
PhoneNumber string `json:"phone_number" binding:"omitempty,min=10,max=15"`
}

// FacultySignup registers a new faculty member.
Expand Down
14 changes: 7 additions & 7 deletions handlers/faculty_post.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,17 +22,17 @@ type PostHandler struct {

// FacultyPostType
type FacultyPostType struct {
Place string `json:"place"`
TypeOfPost string `json:"type_of_post"`
Title string `json:"title"`
Description string `json:"description"`
Place string `json:"place" binding:"required,max=20"`
TypeOfPost string `json:"type_of_post" binding:"required,max=20"`
Title string `json:"title" binding:"required,max=50"`
Description string `json:"description" binding:"required,max=5000"`
}

// FacultyPostEditType
type FacultyPostEditType struct {
Place string `json:"place"`
Title string `json:"title"`
Description string `json:"description"`
Place string `json:"place" binding:"omitempty,max=20"`
Title string `json:"title" binding:"omitempty,max=50"`
Description string `json:"description" binding:"omitempty,max=5000"`
UpdatedAt time.Time `json:"updated_at"`
}

Expand Down
6 changes: 3 additions & 3 deletions handlers/warden_auth.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,9 +15,9 @@ import (
)

type WardenProfileEditType struct {
Name string `json:"name"`
Hostel string `json:"hostel"`
PhoneNumber string `json:"phone_number"`
Name string `json:"name" binding:"omitempty,min=3,max=50"`
Hostel string `json:"hostel" binding:"omitempty,min=3,max=30"`
PhoneNumber string `json:"phone_number" binding:"omitempty,min=10,max=15"`
}


Expand Down
14 changes: 7 additions & 7 deletions handlers/warden_post.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,18 +18,18 @@ import (

// WardenPostEditType
type WardenPostEditType struct {
RoomNumber string `json:"room_number"`
Title string `json:"title"`
Description string `json:"description"`
RoomNumber string `json:"room_number" binding:"omitempty,max=50"`
Title string `json:"title" binding:"omitempty,max=50"`
Description string `json:"description" binding:"omitempty,max=5000"`
UpdatedAt time.Time `json:"updated_at"`
}

// WardenPostType
type WardenPostType struct {
TypeOfPost string `json:"type_of_post"`
RoomNumber string `json:"room_number"`
Title string `json:"title"`
Description string `json:"description"`
TypeOfPost string `json:"type_of_post" binding:"required,max=20"`
RoomNumber string `json:"room_number" binding:"required,max=50"`
Title string `json:"title" binding:"required,max=50"`
Description string `json:"description" binding:"required,max=5000"`
}


Expand Down
4 changes: 2 additions & 2 deletions models/admin_auth.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,6 @@ type Admin struct {
}

type AdminLogin struct {
Email string `json:"email" binding:"required"`
Password string `json:"password" binding:"required"`
Email string `json:"email" binding:"required,email,max=255"`
Password string `json:"password" binding:"required,max=72"`
}
Loading
Loading