[SECURITY] No maximum input length on the task extraction prompt sent to the external language model API, allowing quota exhaustion via oversized inputs

[anshul23102]

Problem

The study plan extraction endpoint accepts arbitrary text input from the user and forwards it directly to the Gemini API without enforcing any maximum length. A user can submit an extremely large text block (e.g., an entire textbook chapter or a several-thousand-word document) as a single prompt, consuming a large number of language model tokens per request. Repeated or automated oversized requests exhaust the project's API quota rapidly, causing the service to fail for all users.

Steps to Reproduce

1. Open the study plan input field
2. Paste a document with 50,000+ characters
3. Submit the form
4. Observe the full text is sent to the external API with no truncation or rejection

Proposed Fix

Enforce a character limit on the input field both client-side (for UX) and server-side (for security):

const MAX_INPUT_CHARS = 3000;

router.post("/extract", async (req, res) => {
  const { prompt } = req.body;
  if (!prompt || typeof prompt !== "string") {
    return res.status(400).json({ error: "Input is required." });
  }
  if (prompt.length > MAX_INPUT_CHARS) {
    return res.status(413).json({
      error: `Input exceeds the maximum allowed length of ${MAX_INPUT_CHARS} characters.`
    });
  }
  // proceed with API call
});

Complexity: Level 2 | Program: GSSOC '26

[anshul23102]

/assign

Claiming this issue for GSSoC '26. Please assign it to me, I'll start working on it right away.

[aaniya22]

pls assign this to me under gssoc

[anshul23102]

Hi @Charushi06, this is a critical security issue. I'd like to work on implementing input validation and length limits for the task extraction prompt. Ready to start immediately.

/assign @anshul23102
/claim

[anshul23102]

Hi @Charushi06, I'd like to work on this. Plan: add a maximum length check on the task extraction prompt before it's sent to the external LLM API, rejecting or truncating oversized inputs to prevent quota exhaustion. Requesting assignment under GSSoC 2026.

/assign
/claim