Repository navigation
Conversation
The preview endpoint compiled the caller's markdown on the server, without authentication and without a size limit. The MDX compile is CPU bound and runs on the event loop of the server, so one large request stops every route of the application from being served, and a large enough one exhausts the Node heap and kills the process. Nothing in the site uses it: the /render page is its only caller and no page, test, script or workflow links to it, so the pair is removed instead of being bounded. The markdown that the site does serve - task statements, solutions and assessment instructions - is compiled by src/lib/renderMarkdown.ts and is not affected.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
What this changes
POST /api/rendercompiled Markdown that the caller sends, using the site's own MDX pipeline (src/lib/renderMarkdown.ts->next-mdx-remote). It accepted any string, with no login and no size limit.The compile is CPU bound and runs inside the request, so the size of the request decides how long the server spends on it, and the answer is much larger than the document that was sent. Because the endpoint is open to anyone, one request with a large document is enough to keep the server busy for a long time and to make the other pages wait.
This pull request deletes the endpoint and the page that calls it:
src/app/api/render/route.ts- deletedsrc/app/render/page.tsx- deletedNothing in the site uses them: no page, test, script or workflow links to
/render, and the endpoint has no other caller. The two files are the whole of the feature that was added ine983e1c, so this is its exact inverse.The Markdown the site does serve - task statements, solutions and assessment instructions - goes through
src/lib/renderMarkdown.tsand is not touched.Checks
/render.POST /api/renderandGET /renderanswer404, and/,/tasksand/api/tasksanswer200.