// backend/src/server.js (line 19)
app.use(express.json()); // Uses default limit of ~100kb

// backend/src/api/middleware/validation.js - MISSING complexity checks
export function validateWorkflowData(req, res, next) {
  const workflow = req.body;
  
  if (!workflow.metadata?.id) {
    return res.status(400).json({...});
  }
  // No checks for nodes.length, edges.length, or structure depth!
  next();
}

// backend/src/server.js (update line 19)
app.use(express.json({ 
  limit: '1mb',  // Maximum request body size
  strict: true   // Only parse arrays and objects
}));

app.use(express.urlencoded({ 
  extended: true, 
  limit: '1mb' 
}));

// backend/src/api/middleware/validation.js
const LIMITS = {
  MAX_NODES: 1000,
  MAX_EDGES: 5000,
  MAX_NAME_LENGTH: 200,
  MAX_DESCRIPTION_LENGTH: 5000,
  MAX_TAGS: 50,
  MAX_NESTED_DEPTH: 10
};

export function validateWorkflowData(req, res, next) {
  const workflow = req.body;
  const errors = [];
  
  // Node count validation
  if (workflow.nodes && workflow.nodes.length > LIMITS.MAX_NODES) {
    errors.push(`Too many nodes (max ${LIMITS.MAX_NODES})`);
  }
  
  // Edge count validation
  if (workflow.edges && workflow.edges.length > LIMITS.MAX_EDGES) {
    errors.push(`Too many edges (max ${LIMITS.MAX_EDGES})`);
  }
  
  // String field length validation
  if (workflow.metadata?.name?.length > LIMITS.MAX_NAME_LENGTH) {
    errors.push(`Name too long (max ${LIMITS.MAX_NAME_LENGTH} characters)`);
  }
  
  if (workflow.metadata?.description?.length > LIMITS.MAX_DESCRIPTION_LENGTH) {
    errors.push(`Description too long (max ${LIMITS.MAX_DESCRIPTION_LENGTH} characters)`);
  }
  
  // Tags validation
  if (workflow.metadata?.tags?.length > LIMITS.MAX_TAGS) {
    errors.push(`Too many tags (max ${LIMITS.MAX_TAGS})`);
  }
  
  // Node data complexity (prevent nested bombs)
  if (workflow.nodes) {
    for (const node of workflow.nodes) {
      if (getObjectDepth(node) > LIMITS.MAX_NESTED_DEPTH) {
        errors.push(`Node data too deeply nested (max depth ${LIMITS.MAX_NESTED_DEPTH})`);
        break;
      }
    }
  }
  
  if (errors.length > 0) {
    return res.status(400).json({
      error: { 
        message: 'Workflow validation failed', 
        details: errors 
      }
    });
  }
  
  next();
}

function getObjectDepth(obj, depth = 0) {
  if (depth > 20) return depth; // Safety cutoff
  if (!obj || typeof obj !== 'object') return depth;
  
  const depths = Object.values(obj).map(v => getObjectDepth(v, depth + 1));
  return Math.max(depth, ...depths);
}

// backend/src/api/middleware/validation.js
export function validateStoreData(req, res, next) {
  const store = req.body;
  const errors = [];
  
  // Viewport validation
  if (store.viewport) {
    if (typeof store.viewport.zoom !== 'number' || 
        store.viewport.zoom < 0.1 || 
        store.viewport.zoom > 10) {
      errors.push('Invalid viewport zoom (must be between 0.1 and 10)');
    }
  }
  
  // Selection validation
  if (store.selectedNodes && store.selectedNodes.length > LIMITS.MAX_NODES) {
    errors.push(`Too many selected nodes (max ${LIMITS.MAX_NODES})`);
  }
  
  // Nested depth check
  if (getObjectDepth(store) > LIMITS.MAX_NESTED_DEPTH) {
    errors.push(`Store state too deeply nested (max depth ${LIMITS.MAX_NESTED_DEPTH})`);
  }
  
  if (errors.length > 0) {
    return res.status(400).json({
      error: { message: 'Store validation failed', details: errors }
    });
  }
  
  next();
}

export const LIMITS = {
  // Request size
  MAX_REQUEST_SIZE: '1mb',
  
  // Workflow li...

</details>

- Fixes clduab11/gemini-flow#70

<!-- START COPILOT CODING AGENT TIPS -->
---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more [Copilot coding agent tips](https://gh.io/copilot-coding-agent-tips) in the docs.