From 9d472290f2ba803ebdddc6fbe1bea895a9538f90 Mon Sep 17 00:00:00 2001 From: Dominik Schmidt Date: Wed, 29 Jul 2026 08:46:46 +0200 Subject: [PATCH] fix: return 413 when the announcement body exceeds the size cap Distinguish the http.MaxBytesReader limit from a malformed body: an oversized payload now returns 413 Request Entity Too Large instead of a generic 400. --- services/web/pkg/announcement/announcement_test.go | 2 +- services/web/pkg/announcement/service.go | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/services/web/pkg/announcement/announcement_test.go b/services/web/pkg/announcement/announcement_test.go index cff3ce46bc..986bc9d40b 100644 --- a/services/web/pkg/announcement/announcement_test.go +++ b/services/web/pkg/announcement/announcement_test.go @@ -170,7 +170,7 @@ var _ = Describe("Service", func() { s := newStore() newService(s, true).Set(resp, req) - Expect(resp.Code).To(Equal(http.StatusBadRequest)) + Expect(resp.Code).To(Equal(http.StatusRequestEntityTooLarge)) got, _ := s.Get() Expect(got.BannerText).To(BeEmpty()) }) diff --git a/services/web/pkg/announcement/service.go b/services/web/pkg/announcement/service.go index 39ef7c9443..2cd541b096 100644 --- a/services/web/pkg/announcement/service.go +++ b/services/web/pkg/announcement/service.go @@ -143,6 +143,11 @@ func (s Service) Set(w http.ResponseWriter, r *http.Request) { var body Announcement if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, _maxBodySize)).Decode(&body); err != nil { + var maxBytesErr *http.MaxBytesError + if errors.As(err, &maxBytesErr) { + w.WriteHeader(http.StatusRequestEntityTooLarge) + return + } w.WriteHeader(http.StatusBadRequest) return }