Function decodeJSONWithLimit

internal/server/server.go:2194–2236

decodeJSONWithLimit is the size-configurable variant. Use this for endpoints that accept large payloads (e.g. bulk-import) where the default cap is too small — but always pass an explicit cap, never remove the wrapper.

(r *http.Request, v interface{}, maxBytes int64)

// default cap is too small — but always pass an explicit cap, never
// remove the wrapper.
func decodeJSONWithLimit(r *http.Request, v interface{}, maxBytes int64) error {
	raw, err := readBodyForDecode(r, maxBytes)
	if err != nil {
		return fmt.Errorf("invalid JSON: %w", err)
	}
	// An EMPTY (or whitespace-only) body must keep returning a wrapped
	// io.EOF. json.Decoder.Decode answered io.EOF there and at least one
	// caller depends on it — handlers_playbooks.go treats
	// errors.Is(err, io.EOF) as "no arguments supplied" and runs anyway —
	// while json.Unmarshal answers a SyntaxError instead, which that check
	// cannot see. Found by TestPlaybookRunAcceptsEmptyBody, which is exactly
	// the wiring a helper-level change is blind to.
	// Trim only the four bytes JSON itself calls whitespace. bytes.TrimSpace
	// uses unicode.IsSpace, which also strips \v, \f, U+00A0 and friends —
	// none of which encoding/json accepts. With TrimSpace a body of just
	// "\v" looked EMPTY here and returned io.EOF, so an EOF-tolerant caller
	// (playbook run, share links) treated a syntactically invalid body as an
	// ABSENT one and proceeded. Same Go-versus-spec whitespace divergence
	// that bites when a Go trim stands in for another grammar's definition
	// (codex round 22).
	if len(bytes.Trim(raw, " \t\r\n")) == 0 {
		return fmt.Errorf("invalid JSON: %w", io.EOF)
	}
	// Refuse a decoded NUL BEFORE unmarshalling, so the value never exists
	// in a Go string that a handler could hand to the store. See
	// bodyDecodesNUL for why the body needs its own rule and why the check
	// cannot be a substring search. BUG-2803.
	if bodyDecodesNUL(raw) {
		return errJSONBodyNUL
	}
	// json.Unmarshal rather than a Decoder over the buffer: it is the
	// cheaper of the two by ~2x in total allocation (see readBodyForDecode's
	// measurement), and it REFUSES trailing non-whitespace after the JSON
	// value where Decode silently ignores it. That second difference is a
	// deliberate behaviour change in the same direction as this fix —
	// malformed input is refused at the door rather than partly consumed —
	// and it is the only compatibility change in BUG-2803. Trailing
	// whitespace, which real clients do send, is still accepted.
	if err := json.Unmarshal(raw, v); err != nil {
		return fmt.Errorf("invalid JSON: %w", err)
	}
	return nil
}

// errJSONBodyNUL is returned by decodeJSON when a string in the request body
// decodes to a value containing a NUL. Every decodeJSON caller already turns