zlei6/ragflow
1
0
Fork 0
mirror of https://github.com/infiniflow/ragflow.git synced 2026-07-08 12:24:48 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(api): cap memory message limit and top_n at REST_API_MAX_PAGE_SIZE (#15376)

Browse Source 
## Related issues

Closes #15375

### What problem does this PR solve?

`GET /api/v1/messages` and `GET /api/v1/messages/search` accepted
unbounded `limit` / `top_n` query parameters while other REST list
endpoints enforce `REST_API_MAX_PAGE_SIZE` (100) via
`validate_rest_api_page_size()`. Oversized values can trigger expensive
memory index queries and large result sets (DoS risk).

### Type of change

- [x] Bug Fix (non-breaking change which fixes an issue)

### Changes

| File | Change |
|------|--------|
| `api/apps/restful_apis/memory_api.py` | Cap `limit` and `top_n` with
`validate_rest_api_page_size`; return argument error when exceeded |
|
`test/testcases/test_web_api/test_message_app/test_message_routes_unit.py`
| Regression tests for oversized `limit` / `top_n` |

### Test plan

- [x] Unit tests added
- [ ] `pytest
test/testcases/test_web_api/test_message_app/test_message_routes_unit.py`

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
jony376
2026-07-05 20:20:13 -07:00
committed by GitHub
parent 534a3a7faa
commit aaade3530e
2 changed files with 41 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
test/testcases/test_web_api/test_message_app/test_message_routes_unit.py
View File

@@ -149,3 +149,36 @@ def test_get_messages_csv_and_missing_memory_ids(monkeypatch):
res = _run(inspect.unwrap(module.get_messages)())
assert res["code"] == module.RetCode.SUCCESS, res
assert isinstance(res["data"], list), res
@pytest.mark.p2
def test_get_messages_rejects_limit_above_rest_api_max(monkeypatch):
module = _load_memory_routes_module(monkeypatch)
monkeypatch.setattr(
module,
"request",
SimpleNamespace(args=_DummyArgs({"memory_id": "m1", "limit": "1000"})),
)
res = _run(inspect.unwrap(module.get_messages)())
assert res["code"] == module.RetCode.ARGUMENT_ERROR, res
assert "page_size must be less than or equal to 100" in res["message"], res
@pytest.mark.p2
def test_search_message_rejects_top_n_above_rest_api_max(monkeypatch):
module = _load_memory_routes_module(monkeypatch)
monkeypatch.setattr(
module,
"request",
SimpleNamespace(
args=_DummyArgs({"memory_id": "m1", "query": "hello", "top_n": "500"})
),
)
async def _search_message(_filter_dict, _params):
return []
monkeypatch.setattr(module.memory_api_service, "search_message", _search_message)
res = _run(inspect.unwrap(module.search_message)())
assert res["code"] == module.RetCode.ARGUMENT_ERROR, res
assert "page_size must be less than or equal to 100" in res["message"], res