Upload folder using huggingface_hub

backend/main.py

@@ -338,6 +338,19 @@ class TicketRequest(BaseModel):
     confidence_threshold: float = 0.20
     duplicate_sensitivity: float = 0.85
 
+    def __init__(self, **data):
+        super().__init__(**data)
+        # Validate image size to prevent memory exhaustion DoS
+        if self.image_base64:
+            # base64 expands binary by ~33%, so 10MB binary ≈ 13.3MB base64
+            max_base64_len = 14_000_000  # ~10MB original image
+            if len(self.image_base64) > max_base64_len:
+                from fastapi import HTTPException
+                raise HTTPException(
+                    status_code=413,
+                    detail="Image too large. Maximum size is 10MB."
+                )
+
 class TicketSaveRequest(BaseModel):
     user_id: str
     subject: str

backend/services/gemini_service.py

@@ -54,6 +54,16 @@ class GeminiService:
             # Decode base64 image (actually the new SDK handles base64 easily if we just pass bytes, 
             # but we can also use PIL if we need to process it)
             image_bytes = base64.b64decode(image_base64)
+
+            # Defense-in-depth: reject oversized images to prevent memory exhaustion
+            max_size_bytes = 10 * 1024 * 1024  # 10MB
+            if len(image_bytes) > max_size_bytes:
+                return {
+                    "image_description": "[Image Too Large] Image exceeds 10MB limit.",
+                    "ocr_text": "",
+                    "detected_problem": ""
+                }
+
             img = Image.open(io.BytesIO(image_bytes))
 
             prompt = (