playground: limit snippet size

Change-Id: If8c35f3f11e65f3ef4185aa125aad57cd14d0beb
Reviewed-on: https://go-review.googlesource.com/3070
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

app/goplay/share.go

diff --git a/app/goplay/share.go b/app/goplay/share.go
index d06d6c1..62ca356 100644
--- a/app/goplay/share.go
+++ b/app/goplay/share.go
@@ -5,18 +5,21 @@
 package goplay
 
 import (
-	"appengine"
-	"appengine/datastore"
 	"bytes"
 	"crypto/sha1"
 	"encoding/base64"
 	"fmt"
 	"io"
 	"net/http"
+
+	"appengine"
+	"appengine/datastore"
 )
 
 const salt = "[replace this with something unique]"
 
+const maxSnippetSize = 1 << 16 // 64KB
+
 type Snippet struct {
 	Body []byte
 }
@@ -43,13 +46,17 @@
 	c := appengine.NewContext(r)
 
 	var body bytes.Buffer
-	_, err := body.ReadFrom(r.Body)
+	_, err := io.Copy(&body, io.LimitReader(r.Body, maxSnippetSize+1))
+	r.Body.Close()
 	if err != nil {
 		c.Errorf("reading Body: %v", err)
 		http.Error(w, "Server Error", http.StatusInternalServerError)
 		return
 	}
-	r.Body.Close()
+	if body.Len() > maxSnippetSize {
+		http.Error(w, "Snippet is too large", http.StatusRequestEntityTooLarge)
+		return
+	}
 
 	snip := &Snippet{Body: body.Bytes()}
 	id := snip.Id()