#399

backend/app/controllers/posts_controller.rb

@@ -1,5 +1,7 @@
 class PostsController < ApplicationController
   Event = Struct.new(:post, :tag, :user, :change_type, :timestamp, keyword_init: true)
+  MAX_BULK_THUMBNAIL_BYTES = 20 * 1024 * 1024
+  MAX_BULK_REQUEST_BYTES = 40 * 1024 * 1024
 
   class VideoMsParseError < ArgumentError
     ;
@@ -210,11 +212,10 @@ class PostsController < ApplicationController
     return head :unauthorized unless current_user
     return head :forbidden unless current_user.gte_member?
     return head :unsupported_media_type unless request.content_mime_type == Mime[:multipart_form]
-
-    result = PostBulkCreator.new(
-        actor: current_user,
-        posts: parse_bulk_posts_manifest,
-        thumbnails: parse_bulk_thumbnails).run
+    return head :payload_too_large if request.content_length.to_i > MAX_BULK_REQUEST_BYTES
+    posts = parse_bulk_posts_manifest
+    thumbnails = parse_bulk_thumbnails(posts.length)
+    result = PostBulkCreator.new(actor: current_user, posts:, thumbnails:).run
     render json: result
   rescue JSON::ParserError
     render_bad_request 'posts manifest の JSON が不正です．'
@@ -541,16 +542,22 @@ class PostsController < ApplicationController
     posts
   end
 
-  def parse_bulk_thumbnails
+  def parse_bulk_thumbnails post_count
     thumbnails = { }
-    post_count = Array(JSON.parse(params[:posts].presence || '[]')).length
+    raw = params[:thumbnails]
+    return thumbnails if raw.blank?
+    raise ArgumentError, 'thumbnail key が不正です．' unless raw.respond_to?(:to_unsafe_h)
 
-    params.to_unsafe_h.each do |key, value|
-      match = key.match(/\Athumbnails\[(\d+)\]\z/)
-      next if match.nil?
+    raw.to_unsafe_h.each do |key, value|
+      raise ArgumentError, 'thumbnail key が不正です．' unless key.to_s.match?(/\A\d+\z/)
 
-      index = Integer(match[1], 10)
+      index = Integer(key, 10)
       raise ArgumentError, 'thumbnail index が範囲外です．' if index.negative? || index >= post_count
+      raise ArgumentError, 'thumbnail index が重複しています．' if thumbnails.key?(index)
+      unless value.is_a?(ActionDispatch::Http::UploadedFile)
+        raise ArgumentError, 'thumbnail upload が不正です．'
+      end
+      raise ArgumentError, 'thumbnail file size が大きすぎます．' if value.size > MAX_BULK_THUMBNAIL_BYTES
 
       thumbnails[index] = value
     end

backend/app/models/post.rb

@@ -15,9 +15,7 @@ class Post < ApplicationRecord
   def self.resized_thumbnail_attachment(upload)
     upload.rewind
     image = MiniMagick::Image.read(upload.read)
-    image.resize '180x180^'
-    image.gravity 'Center'
-    image.extent '180x180'
+    image.resize '180x180'
     image.format 'jpg'
 
     { io: StringIO.new(image.to_blob),

backend/app/services/post_creator.rb

@@ -33,6 +33,9 @@ class PostCreator
       PostVersionRecorder.record!(post:, event_type: :create, created_by_user: @actor)
     end
     post
+  rescue StandardError
+    post&.thumbnail&.purge if post&.thumbnail&.attached?
+    raise
   end
 
   private