v0.1.17: security hardening — 18/20 vulnerabilities fixed

Phase 1 (Critical):
- #1 JWT auth (done in v0.1.16)
- #2 Batch message size validation in send_message_batch.go
- #10 RLock in GetQueueUrlV1 (data race fix)

Phase 2 (AWS-compatible limits):
- #3 QueueName validation: max 80 chars, [a-zA-Z0-9_-](.fifo)?
- #4 WaitTimeSeconds clamped to 0-20
- #5 ReceiveMessageWaitTimeSeconds clamped to 0-20
- #6 DelaySeconds clamped to 0-900
- #7 VisibilityTimeout clamped to 0-43200
- #8 MaxNumberOfMessages clamped to 1-10
- #9 Message attributes limited to 10 per message
- #15 BatchEntryId length validated (max 80)
- #16 DeduplicationID length validated (max 128)
- #17 GroupID length validated (max 128)

Phase 3 (Per-tenant resource limits):
- #11 Max messages per queue (120K standard, 20K FIFO)
- #12 Global tenant limit (1000)
- #3.5 HTTP request body size limit (1MB via MaxBytesReader)

Phase 4 (Stability):
- #14 Duplicates map cleanup (already in PeriodicTasks)
- #13 FIFO group lock timeout (already in visibility timeout reset)
- #18 Redis size guard: skip save if >50MB

Skipped (Low, no real risk):
- #19 {account} URL param (informational only, not used for access)
- #20 ReceiptHandle format (self-validating UUID#UUID)

New file: app/gosqs/validation.go — centralized AWS SQS limits and validators

app/gosqs/send_message_batch.go

@@ -59,11 +59,47 @@ for _, v := range sendEntries {
 if _, ok := ids[v.Id]; ok {
 return utils.CreateErrorResponseV1("BatchEntryIdsNotDistinct", true)
 }
+// Валидация длины BatchEntryId (макс 80 chars)
+if err := ValidateBatchEntryID(v.Id); err != nil {
+return utils.CreateErrorResponseV1("InvalidParameterValue", true)
+}
+// Валидация DeduplicationID и GroupID (макс 128 chars)
+if err := ValidateDeduplicationID(v.MessageDeduplicationId); err != nil {
+return utils.CreateErrorResponseV1("InvalidParameterValue", true)
+}
+if err := ValidateGroupID(v.MessageGroupId); err != nil {
+return utils.CreateErrorResponseV1("InvalidParameterValue", true)
+}
 ids[v.Id] = struct{}{}
 }
 
 sentEntries := make([]models.SendMessageBatchResultEntry, 0)
 log.Debugf("Batch sending to Queue: %s (tenant: %s)", queueName, t.ID)
+
+// Fix #2: проверяем размер каждого сообщения в batch (Critical — batch size bypass)
+maxMsgSize := models.SyncQueues.Queues[key].MaximumMessageSize
+if maxMsgSize <= 0 {
+maxMsgSize = MaxMessageSizeDefault
+}
+for _, entry := range sendEntries {
+if len(entry.MessageBody) > maxMsgSize {
+return utils.CreateErrorResponseV1("MessageTooBig", true)
+}
+// Валидация количества message attributes (макс 10 по AWS)
+if len(entry.MessageAttributes) > MaxMessageAttributes {
+return utils.CreateErrorResponseV1("InvalidParameterValue", true)
+}
+}
+
+// Fix #11: лимит сообщений в очереди — защита от OOM
+models.SyncQueues.RLock()
+currentMsgCount := len(models.SyncQueues.Queues[key].Messages)
+queueIsFIFO := models.SyncQueues.Queues[key].IsFIFO
+models.SyncQueues.RUnlock()
+if currentMsgCount+len(sendEntries) > MaxMessagesForQueue(queueIsFIFO) {
+return utils.CreateErrorResponseV1("OverLimit", true)
+}
+
 for _, sendEntry := range sendEntries {
 msg := models.SqsMessage{MessageBody: sendEntry.MessageBody}
 if len(sendEntry.MessageAttributes) > 0 {