Skip to content

fix: remove the unused markdown preview endpoint - #1004

Open
HEKPYTO wants to merge 1 commit into
programming-in-th:mainfrom
HEKPYTO:fix/render-preview-endpoint-dos
Open

HEKPYTO wants to merge 1 commit into
programming-in-th:mainfrom
HEKPYTO:fix/render-preview-endpoint-dos

Conversation

@HEKPYTO

@HEKPYTO HEKPYTO commented Oct 21, 2026 •

Copy link
Copy Markdown

What this changes

POST /api/render compiled Markdown that the caller sends, using the site's own MDX pipeline (src/lib/renderMarkdown.ts -> next-mdx-remote). It accepted any string, with no login and no size limit.

The compile is CPU bound and runs inside the request, so the size of the request decides how long the server spends on it, and the answer is much larger than the document that was sent. Because the endpoint is open to anyone, one request with a large document is enough to keep the server busy for a long time and to make the other pages wait.

This pull request deletes the endpoint and the page that calls it:

  • src/app/api/render/route.ts - deleted
  • src/app/render/page.tsx - deleted

Nothing in the site uses them: no page, test, script or workflow links to /render, and the endpoint has no other caller. The two files are the whole of the feature that was added in e983e1c, so this is its exact inverse.

The Markdown the site does serve - task statements, solutions and assessment instructions - goes through src/lib/renderMarkdown.ts and is not touched.

Checks

  • Type check, lint and unit tests pass.
  • The production build succeeds and no longer lists /render.
  • In the production build: POST /api/render and GET /render answer 404, and /, /tasks and /api/tasks answer 200.

The preview endpoint compiled the caller's markdown on the server, without
authentication and without a size limit. The MDX compile is CPU bound and
runs on the event loop of the server, so one large request stops every
route of the application from being served, and a large enough one
exhausts the Node heap and kills the process.

Nothing in the site uses it: the /render page is its only caller and no
page, test, script or workflow links to it, so the pair is removed instead
of being bounded. The markdown that the site does serve - task statements,
solutions and assessment instructions - is compiled by
src/lib/renderMarkdown.ts and is not affected.
@coderabbitai

coderabbitai Bot commented Oct 21, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: a33dedb9-9e16-486a-820e-3d5a43b075a9
📥 Commits

Reviewing files that changed from the base of the PR and between 79ad808 and ea566d7.

📒 Files selected for processing: 2
  • src/app/api/render/route.ts
  • src/app/render/page.tsx
💤 Files with no reviewable changes: 2
  • src/app/render/page.tsx
  • src/app/api/render/route.ts

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

📝 Walkthrough

The pull request deletes the client-side MDX render page and the API route that converted submitted Markdown content to HTML.

Changes: MDX render feature removal

Layer / File(s) Summary
Remove render page and API route
src/app/render/page.tsx, src/app/api/render/route.ts
The page’s Markdown editor, POST request, loading state, and rendered output were deleted. The API route’s content validation and MDX-to-HTML response handling were also deleted.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: leomotors

Merge Risk: ⚪ Minimal · up to ea566

The preview page and endpoint are intentionally removed. No actionable merge risk is identified after normal checks.

Pre-merge checks: Passed 5
Check name Status Explanation
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed The title clearly identifies the main change: removal of the unused Markdown preview endpoint. It is concise and directly related to the deleted endpoint and preview feature.
Docstring Coverage Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant