From 10eda446eaca018d4d18944b1966257a78456cdb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=88=98=E8=88=AA=E5=AE=87?= <3364451258@qq.com>
Date: Sun, 5 Jul 2026 01:33:42 +0800
Subject: [PATCH] fix: add field validation to API request models (top_k limit,
 file_name pattern)

---
 src/server/app.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/server/app.py b/src/server/app.py
index bfc5747..0d24080 100644
--- a/src/server/app.py
+++ b/src/server/app.py
@@ -5,7 +5,7 @@ from pathlib import Path
 
 from fastapi import FastAPI, HTTPException, Depends, Request
 from fastapi.responses import RedirectResponse
-from pydantic import BaseModel
+from pydantic import BaseModel, Field
 
 from src.core.config import load_config, EmbedConfig, DEFAULT_CONFIG_PATH
 from src.core.db import VectorDB
@@ -31,12 +31,12 @@ def _is_safe_path(path_str: str) -> bool:
 class IngestRequest(BaseModel):
     file_path: str | None = None
     content: str | None = None
-    file_name: str | None = None
+    file_name: str | None = Field(default=None, max_length=255, pattern=r"^[^\\/:*?\"<>|]+\.md$")
 
 
 class SearchRequest(BaseModel):
-    query: str
-    top_k: int = 10
+    query: str = Field(..., min_length=1, max_length=2000)
+    top_k: int = Field(default=10, ge=1, le=100)
 
 
 # -- 懒加载单例 --