Description
SubmitRequestSchema in packages/shared/src/schemas.ts is z.object({ xdr: z.string().min(1) }), with no maximum length. apps/api-local/src/index.ts:20 already sets a deliberate bodyLimit: 10 * 1024 (10 KB) on the Fastify server "to block oversized payload attacks," but the Vercel functions (api/v1/tx/submit) have no equivalent bound, since they validate against this shared schema rather than a body-limit middleware.
Steps to Reproduce
- Send
POST /api/v1/tx/submit with a xdr string far larger than any real transaction envelope could be (e.g. several MB).
- Compare against the same request sent to the Fastify dev server, which rejects it at the body-limit layer before it reaches validation.
Expected Behavior
The Vercel path should reject oversized xdr payloads the same way the Fastify path does.
Actual Behavior
No length bound exists on the Vercel path; an oversized payload passes schema validation and proceeds to XDR parsing.
Environment
| Field |
Value |
| Network |
N/A |
| Wallet |
N/A |
| Protocol affected |
API |
| Browser (if frontend) |
N/A |
| Node.js version |
N/A |
| pnpm version |
N/A |
Possible Cause / Fix
Add a .max() to SubmitRequestSchema's xdr field, consistent with the existing 10 KB precedent in apps/api-local/src/index.ts:
export const SubmitRequestSchema = z.object({
xdr: z.string().min(1).max(10_000),
});10,000 characters is generously above any real signed Stellar transaction envelope's base64 size while staying bounded, matching the same order of magnitude as the existing apps/api-local body limit.
Description
SubmitRequestSchemainpackages/shared/src/schemas.tsisz.object({ xdr: z.string().min(1) }), with no maximum length.apps/api-local/src/index.ts:20already sets a deliberatebodyLimit: 10 * 1024(10 KB) on the Fastify server "to block oversized payload attacks," but the Vercel functions (api/v1/tx/submit) have no equivalent bound, since they validate against this shared schema rather than a body-limit middleware.Steps to Reproduce
POST /api/v1/tx/submitwith axdrstring far larger than any real transaction envelope could be (e.g. several MB).Expected Behavior
The Vercel path should reject oversized
xdrpayloads the same way the Fastify path does.Actual Behavior
No length bound exists on the Vercel path; an oversized payload passes schema validation and proceeds to XDR parsing.
Environment
Possible Cause / Fix
Add a
.max()toSubmitRequestSchema'sxdrfield, consistent with the existing 10 KB precedent inapps/api-local/src/index.ts:10,000 characters is generously above any real signed Stellar transaction envelope's base64 size while staying bounded, matching the same order of magnitude as the existing
apps/api-localbody limit.