From e7964ad3bc5dee3db8cb80e475e8c43d056686f7 Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Fri, 9 Oct 2026 21:08:57 +0000
Subject: [PATCH 1/2] =?UTF-8?q?=EB=B3=B4=EC=95=88=20=EA=B0=95=ED=99=94:=20?=
 =?UTF-8?q?FastAPI=20Form=20=EC=9E=85=EB=A0=A5=EC=97=90=20max=5Flength=20?=
 =?UTF-8?q?=EC=B6=94=EA=B0=80=20(=EB=A9=94=EB=AA=A8=EB=A6=AC=20=EA=B3=A0?=
 =?UTF-8?q?=EA=B0=88=20DoS=20=EB=B0=A9=EC=A7=80)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/newsdom_api/main.py      |  2 ++
 tests/test_parse_endpoint.py | 22 ++++++++++++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/src/newsdom_api/main.py b/src/newsdom_api/main.py
index f61aafc2..3786f763 100644
--- a/src/newsdom_api/main.py
+++ b/src/newsdom_api/main.py
@@ -205,6 +205,7 @@ async def parse(
     language: Annotated[
         str,
         Form(
+            max_length=50,
             description=(
                 "MinerU language family or compatibility alias (e.g. `ch`, "
                 "`en`, `japan`, `korean`, `arabic`, `devanagari`)."
@@ -214,6 +215,7 @@ async def parse(
     mode: Annotated[
         str,
         Form(
+            max_length=50,
             description=(
                 "MinerU parsing mode: `auto` (born-digital text PDFs skip forced "
                 "OCR), `ocr` (force OCR), or `txt` (embedded text layer only)."
diff --git a/tests/test_parse_endpoint.py b/tests/test_parse_endpoint.py
index 1491ada0..435f7daf 100644
--- a/tests/test_parse_endpoint.py
+++ b/tests/test_parse_endpoint.py
@@ -555,3 +555,25 @@ def spy_unlink(self, missing_ok=False):
     # We should have unlinked exactly one file, which should be in the temp directory
     assert len(unlinked_paths) == 1
     assert "tmp" in unlinked_paths[0].lower() or "temp" in unlinked_paths[0].lower()
+
+def test_parse_endpoint_rejects_overlong_language():
+    client = TestClient(app)
+    response = client.post(
+        "/parse",
+        files={"file": ("fixture.pdf", b"%PDF-1.4\n%synthetic\n", "application/pdf")},
+        data={"language": "a" * 51},
+    )
+
+    assert response.status_code == 422
+    assert response.json()["detail"][0]["type"] == "string_too_long"
+
+def test_parse_endpoint_rejects_overlong_mode():
+    client = TestClient(app)
+    response = client.post(
+        "/parse",
+        files={"file": ("fixture.pdf", b"%PDF-1.4\n%synthetic\n", "application/pdf")},
+        data={"mode": "a" * 51},
+    )
+
+    assert response.status_code == 422
+    assert response.json()["detail"][0]["type"] == "string_too_long"

From fb417afcd1ba3ebee80f0c98c3b12429ed69d087 Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Fri, 9 Oct 2026 21:19:06 +0000
Subject: [PATCH 2/2] =?UTF-8?q?=EB=B3=B4=EC=95=88=20=EA=B0=95=ED=99=94:=20?=
 =?UTF-8?q?FastAPI=20Form=20=EC=9E=85=EB=A0=A5=EC=97=90=20max=5Flength=20?=
 =?UTF-8?q?=EC=B6=94=EA=B0=80=20(=EB=A9=94=EB=AA=A8=EB=A6=AC=20=EA=B3=A0?=
 =?UTF-8?q?=EA=B0=88=20DoS=20=EB=B0=A9=EC=A7=80)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit