[BUG] No file size validation for avatar upload could allow disk exhaustion attack

[vipul674]

Description of the Bug

In backend/app/routes/profile.py, the avatar upload endpoint has no file size limit:

@router.post("/avatar", response_model=UserResponse)
def upload_avatar(
    file: UploadFile = File(...),
    ...
):
    allowed_extensions = [".png", ".jpg", ".jpeg"]
    extension = Path(file.filename).suffix.lower()
    if extension not in allowed_extensions:
        raise ValidationException("Invalid image format")
    filename = f"{uuid.uuid4()}{extension}"
    filepath = UPLOAD_DIR / filename
    with open(filepath, "wb") as buffer:
        shutil.copyfileobj(file.file, buffer)

Only the file extension is validated. There is no:

• Content-length check
• max_length parameter on UploadFile
• Size validation before writing to disk
• Disk quota enforcement

An attacker could upload a multi-gigabyte file, consuming all available disk space on the server. This is a denial-of-service vulnerability.

The document upload endpoint has proper size validation via MAX_UPLOAD_SIZE_MB but the avatar endpoint lacks any such protection.

Steps to Reproduce

1. Authenticate as any user
2. Send a POST request to /profile/avatar with a very large image file (e.g., 10GB)
3. The server writes the entire file to disk without checking its size
4. Disk space is consumed

Expected Behavior

The avatar upload should reject files exceeding a reasonable size (e.g., 5MB) before writing to disk. Add a configurable MAX_AVATAR_SIZE_MB setting.

Affected File

backend/app/routes/profile.py (lines ~36-52)

Suggested Fix

Add size validation:

MAX_AVATAR_SIZE = 5 * 1024 * 1024  # 5MB
if file.size and file.size > MAX_AVATAR_SIZE:
    raise ValidationException("Avatar image must be under 5MB")

Or use file = File(..., max_length=5_000_000) to have FastAPI enforce the limit.

GSSoC '26

• Yes, I am participating in GirlScript Summer of Code and would like to fix this.

[github-actions]

Hi @vipul674! 👋

Thanks for opening this issue! We are thrilled to have you contribute to PDF-Assistant-RAG for GSSoC 2026.

📌 Before you start:

• Make sure you have read our Contributing Guidelines.
• Wait for a project admin to assign this issue to you before working on it.
• Remember to branch off dev and not main.

Happy Coding! 🚀

[vipul674]

@param20h I would like to work on this issue under GSSoC 2026. Please assign it to me.