Current state with latest updates

app/Http/Controllers/Web/SearchController.php

@@ -11,6 +11,7 @@ use App\Services\GroupDiscoveryService;
 use Illuminate\Database\Eloquent\Collection as EloquentCollection;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 use Illuminate\Support\Arr;
 use Illuminate\View\View;
 use cPad\Plugins\News\Models\NewsArticle;
@@ -19,6 +20,12 @@ final class SearchController extends Controller
 {
     private const ALLOWED_SORTS = ['latest', 'popular', 'likes', 'downloads'];
 
+    /** Reject requests with an absurd number of query params before touching search/DB. */
+    private const MAX_QUERY_PARAMS = 15;
+
+    /** Reject requests with an absurdly long query string before touching search/DB. */
+    private const MAX_QUERY_STRING_LENGTH = 500;
+
     public function __construct(
         private readonly ArtworkSearchService $search,
         private readonly GroupDiscoveryService $groups,
@@ -26,6 +33,8 @@ final class SearchController extends Controller
 
     public function index(Request $request): View|RedirectResponse
     {
+        $this->rejectMalformedQuery($request);
+
         $canonicalQuery = $this->canonicalQueryParameters($request);
         $canonicalUrl = $this->canonicalSearchUrl($request, $canonicalQuery);
 
@@ -110,6 +119,21 @@ final class SearchController extends Controller
         ]);
     }
 
+    /**
+     * Bail out before any search/DB work for junk requests — e.g. scripted
+     * floods that repeat/nest query params (group=all&page=..&sort=.. etc.).
+     */
+    private function rejectMalformedQuery(Request $request): void
+    {
+        $query = $request->query();
+
+        if (count($query) > self::MAX_QUERY_PARAMS
+            || strlen((string) $request->getQueryString()) > self::MAX_QUERY_STRING_LENGTH
+        ) {
+            abort(Response::HTTP_BAD_REQUEST);
+        }
+    }
+
     /**
      * @return array<string, int|string>
      */