continuwuation/continuwuity

Fork 109

docs: clarify max_request_size limiting federation #1706

Merged

nex merged 4 commits from grgergo/continuwuity:docs-max_request_size into main

2026-05-04 14:17:32 +00:00

grgergo commented

2026-04-26 10:36:13 +00:00

Contributor

Clarifies in the config that max_request_size affects federated media as well.
Mostly because it took me 20 minutes to figure out why Firefox was opening a .flac file in vim...

Pull request checklist:

This pull request targets the main branch, and the branch is named something other than
main.
I have written an appropriate pull request title and my description is clear.
I understand I am responsible for the contents of this pull request.
I have followed the contributing guidelines:
- My contribution follows the code style, if applicable.
- I ran pre-commit checks before opening/drafting this pull request.
- I have tested my contribution (or proof-read it for documentation-only changes)
  myself, if applicable. This includes ensuring code compiles.
- My commit messages follow the commit message format and are descriptive.
- I have written a news fragment for this PR, if applicable.

Clarifies in the config that `max_request_size` affects federated media as well. Mostly because it took me 20 minutes to figure out why Firefox was opening a `.flac` file in `vim`... **Pull request checklist:** - [x] This pull request targets the `main` branch, and the branch is named something other than `main`. - [x] I have written an appropriate pull request title and my description is clear. - [x] I understand I am responsible for the contents of this pull request. - I have followed the [contributing guidelines][c1]: - [x] My contribution follows the [code style][c2], if applicable. - [x] I ran [pre-commit checks][c1pc] before opening/drafting this pull request. - [x] I have [tested my contribution][c1t] (or proof-read it for documentation-only changes) myself, if applicable. This includes ensuring code compiles. - [x] My commit messages follow the [commit message format][c1cm] and are descriptive. - [x] I have written a [news fragment][n1] for this PR, if applicable. [c1]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/CONTRIBUTING.md [c2]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/docs/development/code_style.mdx [c1pc]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/CONTRIBUTING.md#pre-commit-checks [c1t]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/CONTRIBUTING.md#running-tests-locally [c1cm]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/CONTRIBUTING.md#commit-messages [n1]: https://towncrier.readthedocs.io/en/stable/tutorial.html#creating-news-fragments

forgejo-actions added the

Changelog

Added

label

2026-04-26 10:36:47 +00:00

spaetz commented

2026-04-27 11:07:35 +00:00

Member

Question is whether that is what is actually intended or not (

.max_request_size

?!)

Should max_request_size be concerned with incoming media too and not only uploads? It is not an intuitive behaviour, I would say.

Question is whether that is what is actually intended or not (https://forgejo.ellis.link/continuwuation/continuwuity/src/commit/754959e80d4865cfcfd9c0de10ab9391b11bac39/src/service/media/remote.rs#L293 ?!) Should max_request_size be concerned with incoming media too and not only uploads? It is not an intuitive behaviour, I would say.

Aranjedeath commented

2026-04-27 13:50:05 +00:00

Owner

@spaetz wrote in #1706 (comment):

Should max_request_size be concerned with incoming media too and not only uploads? It is not an intuitive behaviour, I would say.

This is a docs clarification request, but it is indeed intended that "a" request size limit applies everywhere. Without a limit, it's a security vulnerability.

@spaetz wrote in https://forgejo.ellis.link/continuwuation/continuwuity/pulls/1706#issuecomment-28564: > Should max_request_size be concerned with incoming media too and not only uploads? It is not an intuitive behaviour, I would say. This is a docs clarification request, but it is indeed intended that "a" request size limit applies everywhere. Without a limit, it's a security vulnerability.

nex added the

Documentation

Enhancement

labels

2026-04-28 02:21:03 +00:00

nex commented

2026-04-28 02:23:19 +00:00

Owner

For context: This max size was applied to all remote responses, excluding the federated send_join endpoint, to mitigate an attack vector that was actively being exploited, albeit unintentionally: 37888fb670

The intention was not that this would then cap remote media size too, however the followup change that allowed overriding it for media specifically was never made. For now, noting this restriction in the docs is probably the easiest solution.

For context: This max size was applied to *all* remote responses, excluding the federated `send_join` endpoint, to mitigate an attack vector that was actively being exploited, albeit unintentionally: https://forgejo.ellis.link/continuwuation/continuwuity/commit/37888fb67098c7dfba680cea122bc72c3a970406 The intention was not that this would then cap remote media size too, however the followup change that allowed overriding it for media specifically was never made. For now, noting this restriction in the docs is probably the easiest solution.

nex requested changes

2026-04-28 02:25:29 +00:00

Dismissed

nex left a comment

Example config file needs regenerating (run cargo build), otherwise looks fine

Example config file needs regenerating (run `cargo build`), otherwise looks fine

nex approved these changes

2026-05-04 13:55:34 +00:00

nex force-pushed docs-max_request_size from 7985a2e4b3

Documentation / Build and Deploy Documentation (pull_request) Has been skipped

Details

Checks / Prek / Check changed files (pull_request) Successful in 6s