From 440654f4fc764a32073592e32ce5bc51b34ac24c Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Sun, 17 May 2026 04:27:05 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[MEDIUM]=20?=
 =?UTF-8?q?Add=20input=20length=20validation=20to=20API=20Item=20model?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Added min_length and max_length constraints to 'id' and 'name' fields in the API Item model.
This mitigates Denial of Service (DoS) risks and ensures data integrity.
Added a unit test to verify that oversized payloads are rejected with a 422 status code.
---
 templates/api/models.py   |  6 ++++--
 tests/api/test_handler.py | 14 ++++++++++++++
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/templates/api/models.py b/templates/api/models.py
index 5a2d8f8..39b121f 100644
--- a/templates/api/models.py
+++ b/templates/api/models.py
@@ -6,8 +6,10 @@
 
 
 class Item(BaseModel, populate_by_name=True, alias_generator=to_camel):
-    id: str = Field(description="Unique item identifier", default_factory=lambda: str(uuid4()))
-    name: str = Field(description="Human-readable item name")
+    id: str = Field(
+        description="Unique item identifier", default_factory=lambda: str(uuid4()), min_length=1, max_length=50
+    )
+    name: str = Field(description="Human-readable item name", min_length=1, max_length=100)
 
     def dump(self, **kwargs: Any) -> str:
         """Dump the model to a JSON string with default settings for API responses."""
diff --git a/tests/api/test_handler.py b/tests/api/test_handler.py
index 4626930..225fe41 100644
--- a/tests/api/test_handler.py
+++ b/tests/api/test_handler.py
@@ -109,6 +109,20 @@ def test_post_item_invalid_body(mock_repo, lambda_context):
     assert "errors" in body
 
 
+def test_post_item_name_too_long(mock_repo, lambda_context):
+    """POST /items returns 422 when the name exceeds the maximum length."""
+    from templates.api.handler import main
+
+    long_name = "a" * 101
+    event = _apigw_event("POST", "/items", body={"id": "xyz", "name": long_name})
+    response = main(event, lambda_context)
+
+    assert response["statusCode"] == 422
+    body = loads(response["body"])
+    assert "errors" in body
+    assert any(err["type"] == "string_too_long" for err in body["errors"])
+
+
 def test_get_item_dynamodb_error(mock_repo, lambda_context):
     """GET /items/{id} returns 500 when the repository raises an exception."""
     import templates.api.handler as handler_module