mirror of
https://github.com/infiniflow/ragflow.git
synced 2026-07-06 19:38:36 +08:00
aaade3530e
## Related issues Closes #15375 ### What problem does this PR solve? `GET /api/v1/messages` and `GET /api/v1/messages/search` accepted unbounded `limit` / `top_n` query parameters while other REST list endpoints enforce `REST_API_MAX_PAGE_SIZE` (100) via `validate_rest_api_page_size()`. Oversized values can trigger expensive memory index queries and large result sets (DoS risk). ### Type of change - [x] Bug Fix (non-breaking change which fixes an issue) ### Changes | File | Change | |------|--------| | `api/apps/restful_apis/memory_api.py` | Cap `limit` and `top_n` with `validate_rest_api_page_size`; return argument error when exceeded | | `test/testcases/test_web_api/test_message_app/test_message_routes_unit.py` | Regression tests for oversized `limit` / `top_n` | ### Test plan - [x] Unit tests added - [ ] `pytest test/testcases/test_web_api/test_message_app/test_message_routes_unit.py` Co-authored-by: Cursor <cursoragent@cursor.com>