refactor(viewer): consolidate rendering and harden uploads

viewer/handler.go

@@ -12,21 +12,20 @@ import (
 )
 
 type HandlerOptions struct {
-	Title      string
-	Standalone bool
+	Title string
 }
 
+const maxSnapshotRequestBytes int64 = 64 << 20
+
 func NewHandler(opts HandlerOptions) http.Handler {
-	opts.Standalone = false
-	return newHandler(opts)
+	return newHandler(opts, false)
 }
 
 func NewStandaloneHandler(opts HandlerOptions) http.Handler {
-	opts.Standalone = true
-	return newHandler(opts)
+	return newHandler(opts, true)
 }
 
-func newHandler(opts HandlerOptions) http.Handler {
+func newHandler(opts HandlerOptions, standalone bool) http.Handler {
 	title := strings.TrimSpace(opts.Title)
 	if title == "" {
 		title = "Reanimator Chart"
@@ -43,7 +42,7 @@ func newHandler(opts HandlerOptions) http.Handler {
 			html []byte
 			err  error
 		)
-		if opts.Standalone {
+		if standalone {
 			html, err = web.RenderUpload(pageData{Title: title})
 		} else {
 			html, err = RenderHTML(nil, title)
@@ -56,6 +55,7 @@ func newHandler(opts HandlerOptions) http.Handler {
 		_, _ = w.Write(html)
 	})
 	mux.HandleFunc("POST /render", func(w http.ResponseWriter, r *http.Request) {
+		r.Body = http.MaxBytesReader(w, r.Body, maxSnapshotRequestBytes)
 		payload, err := readSnapshotPayload(r)
 		if err != nil {
 			http.Error(w, err.Error(), http.StatusBadRequest)
@@ -64,7 +64,7 @@ func newHandler(opts HandlerOptions) http.Handler {
 
 		page, err := buildPageData([]byte(payload), title, RenderOptions{})
 		if err != nil {
-			if opts.Standalone {
+			if standalone {
 				html, renderErr := web.RenderUpload(pageData{
 					Title: title,
 					Error: err.Error(),
@@ -105,8 +105,12 @@ func readSnapshotPayload(r *http.Request) (string, error) {
 		}
 		return string(body), nil
 	case "multipart/form-data":
-		if err := r.ParseMultipartForm(32 << 20); err != nil {
-			return "", fmt.Errorf("parse multipart form: %w", err)
+		parseErr := r.ParseMultipartForm(32 << 20)
+		if r.MultipartForm != nil {
+			defer r.MultipartForm.RemoveAll()
+		}
+		if parseErr != nil {
+			return "", fmt.Errorf("parse multipart form: %w", parseErr)
 		}
 
 		payload, err := readSnapshotFile(r, "snapshot_file")