introduce limits

src/endpoints/elevators.cc

@@ -57,6 +57,8 @@ void tag_invoke(boost::json::value_from_tag,
 
 namespace motis::ep {
 
+constexpr auto const kLimit = 4096U;
+
 json::value elevators::operator()(json::value const& query) const {
   auto const rt = rt_;
   auto const e = rt->e_.get();
@@ -68,6 +70,7 @@ json::value elevators::operator()(json::value const& query) const {
 
   auto matches = json::array{};
   e->elevators_rtree_.find(geo::box{min, max}, [&](elevator_idx_t const i) {
+    utl::verify(matches.size() < kLimit, "too many elevators");
     auto const& x = e->elevators_[i];
     matches.emplace_back(json::value{
         {"type", "Feature"},
@@ -86,6 +89,7 @@ json::value elevators::operator()(json::value const& query) const {
     auto const pos = w_.get_node_pos(n);
     if (match != elevator_idx_t::invalid()) {
       auto const& x = e->elevators_[match];
+      utl::verify(matches.size() < kLimit, "too many elevators");
       matches.emplace_back(json::value{
           {"type", "Feature"},
           {"properties",

src/endpoints/map/stops.cc

@@ -18,7 +18,9 @@ api::stops_response stops::operator()(boost::urls::url_view const& url) const {
   utl::verify(min.has_value(), "min not a coordinate: {}", query.min_);
   utl::verify(max.has_value(), "max not a coordinate: {}", query.max_);
   auto res = api::stops_response{};
+  auto n_items = 0U;
   loc_rtree_.find({min->pos_, max->pos_}, [&](n::location_idx_t const l) {
+    utl::verify(n_items < 2048U, "too many items");
     res.emplace_back(to_place(&tt_, &tags_, w_, pl_, matches_, tt_location{l}));
   });
   return res;

src/endpoints/matches.cc

@@ -27,7 +27,10 @@ json::value matches::operator()(json::value const& query) const {
 
   auto matches = json::array{};
 
+  auto n_items = 0U;
   pl_.find(min, max, [&](osr::platform_idx_t const p) {
+    utl::verify(n_items < 2048U, "too many items");
+
     auto const center = get_platform_center(pl_, w_, p);
     if (!center.has_value()) {
       return;
@@ -42,6 +45,8 @@ json::value matches::operator()(json::value const& query) const {
   });
 
   loc_rtree_.find({min, max}, [&](n::location_idx_t const l) {
+    utl::verify(n_items < 2048U, "too many items");
+
     auto const pos = tt_.locations_.coordinates_[l];
     auto const match = get_match(tt_, pl_, w_, l);
     auto props =

src/endpoints/platforms.cc

@@ -6,6 +6,8 @@ namespace json = boost::json;
 
 namespace motis::ep {
 
+constexpr auto const kLimit = 4096U;
+
 json::value platforms::operator()(json::value const& query) const {
   auto const& q = query.as_object();
   auto const level = q.contains("level")
@@ -20,6 +22,7 @@ json::value platforms::operator()(json::value const& query) const {
   auto gj = osr::geojson_writer{.w_ = w_, .platforms_ = &pl_};
   pl_.find(min, max, [&](osr::platform_idx_t const i) {
     if (level == osr::kNoLevel || pl_.get_level(w_, i) == level) {
+      utl::verify(gj.features_.size() < kLimit, "too many platforms");
       gj.write_platform(i);
     }
   });

src/endpoints/stop_times.cc

@@ -277,6 +277,7 @@ std::vector<n::rt::run> get_events(
 api::stoptimes_response stop_times::operator()(
     boost::urls::url_view const& url) const {
   auto const query = api::stoptimes_params{url.params()};
+  utl::verify(query.n_ < 256, "n={} > 256 not allowed", query.n_);
 
   auto const x = tags_.get_location(tt_, query.stopId_);
   auto const p = tt_.locations_.parents_[x];

src/railviz.cc

@@ -34,6 +34,8 @@
 
 namespace n = nigiri;
 
+constexpr auto const kLimit = 4096U;
+
 using static_rtree = cista::raw::rtree<n::route_idx_t>;
 using rt_rtree = cista::raw::rtree<n::rt_transport_idx_t>;
 
@@ -233,6 +235,7 @@ void add_rt_transports(n::timetable const& tt,
         n::interval{from.time(n::event_type::kDep),
                     to.time(n::event_type::kArr) + n::i32_minutes{1}};
     if (active.overlaps(time_interval)) {
+      utl::verify(runs.size() < kLimit, "too many trips");
       runs.emplace_back(
           stop_pair{.r_ = fr,  // NOLINT(cppcoreguidelines-slicing)
                     .from_ = from.stop_idx_,
@@ -290,6 +293,7 @@ void add_static_transports(n::timetable const& tt,
                                     tt.event_time(t, to, n::event_type::kArr) +
                                         n::unixtime_t::duration{1}}) &&
             is_active(t)) {
+          utl::verify(runs.size() < kLimit, "too many trips");
           runs.emplace_back(stop_pair{
               .r_ = n::rt::run{.t_ = t,
                                .stop_range_ = {from, static_cast<n::stop_idx_t>(