httpapi: validate /api/concurrency payloads to prevent invalid settings; add tests

[eltypical]

Summary

Add input validation to internal/httpapi API endpoint that adjusts runtime concurrency. Reject negative values and invalid or negative rate_limit_duration, and accept 0 as a no-op reset. This prevents invalid values from propagating into runner options and the JS engine concurrency metrics.

Root-cause trace

• Location: internal/httpapi/apiendpoint.go
• Before: updateSettings applied values from JSON payload without checking for negative integers or invalid duration strings. A malicious/buggy client could submit negative values, leading to unexpected behavior (e.g., negative concurrency/misconfig), potential panics in downstream codepaths that assume non-negative bounds, or event-loop starvation.
• After: The handler now validates:
  • Non-negative constraints for BulkSize, Threads, RateLimit, PayloadConcurrency, ProbeConcurrency, JavascriptConcurrency.
  • RateLimitDuration is parsed via time.ParseDuration and must be >= 0.
  • 0 values are accepted but do not mutate the existing configuration (no-op), preserving prior behavior for unspecified settings.

Impact Matrix

Component	CIA Vector	Core Location	Vulnerable Pattern	Fix	Impact
HTTP API (concurrency)	Integrity/Availability	internal/httpapi/apiendpoint.go	Missing input validation (negative ints, invalid duration)	Validate numeric bounds, parse & bound duration	Prevents invalid runtime settings that can cause downstream panics or misbehavior under load

Tests

• Added internal/httpapi/apiendpoint_test.go
  • TestUpdateSettings_RejectsNegativeValues -> 400 Bad Request
  • TestUpdateSettings_DurationParsingAndBounds -> 400 on invalid/negative durations
  • TestUpdateSettings_ZeroValuesNoChange -> 200 OK, config unchanged

How to run

• go test ./internal/httpapi -v

Notes

• Change is surgical (<50 LoC) and confined to httpapi endpoint. No external API changes.
• Signed-off-by aligns with committer noreply: Kiell Tampubolon 113831023+eltypical@users.noreply.github.com

Signed-off-by: Kiell Tampubolon 113831023+eltypical@users.noreply.github.com

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c135c738-73b7-4f59-b92d-b7571a6d0086

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}