Problem
The content field passed to edit_file and edit_multiple_files AI tools in app/api/chat/route.ts has no length validation. An adversarial or runaway AI response could craft an unbounded payload, causing high memory usage, slow response times, or triggering provider timeouts.
Proposed Fix
Add Zod schema validation before processing tool calls:
const editSchema = z.object({
path: z.string().max(500),
content: z.string().max(500_000), // 500KB max per file
});Also consider:
- Rejecting requests with a total body size above a configurable threshold (e.g., 2MB)
-
- Returning a
413 Payload Too Large status when limits are exceeded
Problem
The
contentfield passed toedit_fileandedit_multiple_filesAI tools inapp/api/chat/route.tshas no length validation. An adversarial or runaway AI response could craft an unbounded payload, causing high memory usage, slow response times, or triggering provider timeouts.Proposed Fix
Add Zod schema validation before processing tool calls:
Also consider:
413 Payload Too Largestatus when limits are exceeded