docs: cookbook additions (Security Headers, File Upload Safety)#133
docs: cookbook additions (Security Headers, File Upload Safety)#133
Conversation
- Added new recipe: `security_headers.md` (HSTS, CSP, X-Frame-Options). - Updated `file_uploads.md`: Added warnings about memory buffering and examples for manual validation. - Updated `advanced_middleware.md`: Added reverse proxy configuration section. - Enhanced Learning Path Module 5 with a specific mini-project. - Created `docs/.agent/docs_coverage.md` to track documentation gaps.
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
There was a problem hiding this comment.
Pull request overview
This PR enhances the RustAPI Cookbook with critical security and safety documentation. It adds a comprehensive Security Headers recipe covering HSTS, CSP, and X-Frame-Options, and significantly improves the File Uploads guide with prominent warnings about memory buffering and detailed manual validation examples. The Learning Path curriculum is refined to better scaffold validation concepts by connecting Module 5 (Validation) back to Module 3's User Registry project. An internal documentation coverage map is also introduced for tracking feature documentation status.
Changes:
- New Security Headers recipe with practical examples for production-ready HTTP security headers
- Enhanced File Uploads guide emphasizing buffering limitations and manual validation requirements
- Refined Learning Path to create better progression from basic handlers to validated endpoints
- Added documentation coverage tracking for internal maintenance
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| docs/cookbook/src/recipes/security_headers.md | New recipe covering SecurityHeadersLayer with basic, strict, and custom configurations |
| docs/cookbook/src/recipes/file_uploads.md | Added buffering warnings, manual validation section, and corrected body_limit usage |
| docs/cookbook/src/recipes/advanced_middleware.md | Added reverse proxy IP extraction documentation for RateLimitLayer |
| docs/cookbook/src/learning/curriculum.md | Enhanced Module 5 with mini-project and linked it to Module 3's User Registry |
| docs/cookbook/src/SUMMARY.md | Added Security Headers recipe to table of contents |
| docs/.agent/run_report_2026-02-24.md | Internal run report documenting changes made |
| docs/.agent/last_run.json | Updated tracking metadata |
| docs/.agent/docs_coverage.md | Comprehensive feature-to-documentation mapping table |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| RustApi::new() | ||
| // Increase body limit to 1GB (default is usually 1MB) | ||
| .body_limit(1024 * 1024 * 1024) | ||
| // Increase body limit to 50MB (default is 2MB) |
There was a problem hiding this comment.
The default body limit is 1MB (1024 * 1024 bytes), not 2MB. This is confirmed in the codebase at crates/rustapi-core/src/middleware/body_limit.rs:28 where DEFAULT_BODY_LIMIT is set to 1024 * 1024. Update this comment to reflect the correct default value.
| // Increase body limit to 50MB (default is 2MB) | |
| // Increase body limit to 50MB (default is 1MB = 1024 * 1024 bytes) |
|
|
||
| ### Configuration | ||
|
|
||
| You must explicitly increase the body limit for any upload route, as the default is 2MB to prevent DoS attacks. |
There was a problem hiding this comment.
The default body limit is 1MB, not 2MB. According to crates/rustapi-core/src/middleware/body_limit.rs:28, DEFAULT_BODY_LIMIT is set to 1024 * 1024 bytes (1MB). Update this to state "default is 1MB" for accuracy.
| You must explicitly increase the body limit for any upload route, as the default is 2MB to prevent DoS attacks. | |
| You must explicitly increase the body limit for any upload route, as the default is 1MB to prevent DoS attacks. |
|
|
||
| ```rust | ||
| use rustapi_rs::prelude::*; | ||
| use rustapi_rs::extract::{Multipart, DefaultBodyLimit}; |
There was a problem hiding this comment.
The import DefaultBodyLimit is incorrect. This type does not exist in the rustapi-core crate. Since the code no longer uses DefaultBodyLimit::max(...) (which was correctly removed), this import should also be removed from the use statement.
| // Never trust the user-provided filename directly! | ||
| let safe_filename = format!("{}-{}", uuid::Uuid::new_v4(), file_name); | ||
| let path = Path::new("./uploads").join(&safe_filename); | ||
|
|
||
| // 3. Save to Disk | ||
| tokio::fs::write(&path, &data).await.map_err(|e| ApiError::internal(e.to_string()))?; | ||
|
|
There was a problem hiding this comment.
The generated safe_filename still incorporates the untrusted file_name directly, which may contain sequences like ../ or path separators. When combined with Path::new("./uploads").join(&safe_filename), an attacker can craft filenames such that .. segments escape the intended ./uploads directory and overwrite or create files elsewhere on the filesystem (path traversal). To avoid this, either completely reject path separators/.. in file_name or ignore the client-provided name for the on-disk path (e.g., use only a server-generated identifier and store the original name separately in metadata).
1 participant
This PR improves the RustAPI Cookbook by adding a dedicated recipe for Security Headers and enhancing the File Uploads guide with critical safety information regarding memory usage and manual validation. It also refines the Learning Path to better scaffold validation concepts and introduces a documentation coverage map for internal tracking.
PR created automatically by Jules for task 13544147916072688995 started by @Tuntii