v0.1.17: security hardening — 18/20 vulnerabilities fixed

Phase 1 (Critical):
- #1 JWT auth (done in v0.1.16)
- #2 Batch message size validation in send_message_batch.go
- #10 RLock in GetQueueUrlV1 (data race fix)

Phase 2 (AWS-compatible limits):
- #3 QueueName validation: max 80 chars, [a-zA-Z0-9_-](.fifo)?
- #4 WaitTimeSeconds clamped to 0-20
- #5 ReceiveMessageWaitTimeSeconds clamped to 0-20
- #6 DelaySeconds clamped to 0-900
- #7 VisibilityTimeout clamped to 0-43200
- #8 MaxNumberOfMessages clamped to 1-10
- #9 Message attributes limited to 10 per message
- #15 BatchEntryId length validated (max 80)
- #16 DeduplicationID length validated (max 128)
- #17 GroupID length validated (max 128)

Phase 3 (Per-tenant resource limits):
- #11 Max messages per queue (120K standard, 20K FIFO)
- #12 Global tenant limit (1000)
- #3.5 HTTP request body size limit (1MB via MaxBytesReader)

Phase 4 (Stability):
- #14 Duplicates map cleanup (already in PeriodicTasks)
- #13 FIFO group lock timeout (already in visibility timeout reset)
- #18 Redis size guard: skip save if >50MB

Skipped (Low, no real risk):
- #19 {account} URL param (informational only, not used for access)
- #20 ReceiptHandle format (self-validating UUID#UUID)

New file: app/gosqs/validation.go — centralized AWS SQS limits and validators

app/gosqs/send_message.go

@@ -38,6 +38,18 @@ func SendMessageV1(req *http.Request) (int, interfaces.AbstractResponseBody) {
 	messageGroupID := requestBody.MessageGroupId
 	messageDeduplicationID := requestBody.MessageDeduplicationId
 
+	// Валидация DeduplicationID и GroupID (макс 128 chars по AWS)
+	if err := ValidateDeduplicationID(messageDeduplicationID); err != nil {
+		return utils.CreateErrorResponseV1("InvalidParameterValue", true)
+	}
+	if err := ValidateGroupID(messageGroupID); err != nil {
+		return utils.CreateErrorResponseV1("InvalidParameterValue", true)
+	}
+	// Валидация количества message attributes (макс 10)
+	if len(requestBody.MessageAttributes) > MaxMessageAttributes {
+		return utils.CreateErrorResponseV1("InvalidParameterValue", true)
+	}
+
 	queueUrl := getQueueFromPath(requestBody.QueueUrl, req.URL.String())
 	queueName := ""
 	if queueUrl == "" {
@@ -60,6 +72,15 @@ func SendMessageV1(req *http.Request) (int, interfaces.AbstractResponseBody) {
 		return utils.CreateErrorResponseV1("MessageTooBig", true)
 	}
 
+	// Fix #11: лимит сообщений в очереди — защита от OOM
+	models.SyncQueues.RLock()
+	currentMsgCount := len(models.SyncQueues.Queues[key].Messages)
+	queueIsFIFO := models.SyncQueues.Queues[key].IsFIFO
+	models.SyncQueues.RUnlock()
+	if currentMsgCount >= MaxMessagesForQueue(queueIsFIFO) {
+		return utils.CreateErrorResponseV1("OverLimit", true)
+	}
+
 	delaySecs := models.SyncQueues.Queues[key].DelaySeconds
 	if requestBody.DelaySeconds != 0 {
 		delaySecs = requestBody.DelaySeconds