From 3a357e4f0b787f05dff2a6f44b2a6d9c88d6265b Mon Sep 17 00:00:00 2001 From: Carlos Escalante Date: Tue, 9 Jun 2026 19:13:32 -0600 Subject: [PATCH] Cap paste-import payload at 1 MB (ARCH-05) Co-Authored-By: Claude Fable 5 --- backend/app/api/v1/endpoints/import_transactions.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/backend/app/api/v1/endpoints/import_transactions.py b/backend/app/api/v1/endpoints/import_transactions.py index 2746ad3..db4e8c4 100644 --- a/backend/app/api/v1/endpoints/import_transactions.py +++ b/backend/app/api/v1/endpoints/import_transactions.py @@ -4,7 +4,7 @@ from datetime import datetime from typing import Optional from fastapi import APIRouter, Depends -from pydantic import BaseModel +from pydantic import BaseModel, Field from sqlmodel import Session, select from app.auth import get_current_user @@ -22,7 +22,8 @@ router = APIRouter(prefix="/import", tags=["import"]) class PasteImportRequest(BaseModel): - text: str + # ~1 MB cap: a full statement paste is a few KB; anything larger is abuse. + text: str = Field(max_length=1_000_000) bank: Bank = Bank.BAC source: TransactionSource = TransactionSource.CREDIT_CARD