[backend][security] Search/SQL endpoints lack query size and complexity limits

[Xhristin3]

Severity

High

Files

app/backend/src/search/, app/backend/src/referrals/, app/backend/src/booking/**

Description

Several full-text-search and filtering endpoints accept arbitrary query strings without length limits, and may allow deeply nested filters. Without limits, an attacker can craft requests that time-out the DB.

Acceptance Criteria

• Cap query string length at e.g. 256 chars (configurable)
• Cap filter complexity (max OR clauses, max AND nesting)
• Add a test: a deeply nested filter returns 400 Bad Request
• Document limits in docs/api/query-limits.md

[Rocket1960]

This is a high-severity issue I can close cleanly. I have experience hardening query endpoints against DoS-style abuse,capping input length and filter complexity at the validation layer before anything touches the DB is the right approach, and I know how to make those limits configurable so they can be tightened without a code change. I'll apply the guards consistently across the search, referrals, and booking modules, write the test that confirms deeply nested filters return a proper 400, and document the enforced limits in docs/api/query-limits.md so downstream consumers know exactly what to expect.

[grantfox-oss]

🦊 GrantFox — @Rocket1960 has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #533)
2. Your PR will be reviewed by the Gatheraa maintainers

Good luck! Track your progress on GrantFox.