fix(api): bound claim wire fields end to end

admin/internal/server/task_claims.go

@@ -14,7 +14,10 @@ import (
 	"github.com/gin-gonic/gin"
 )
 
-const maxClaimJSONBytes = 4096
+const (
+	maxClaimJSONBytes         = 4096
+	maxClaimResponseJSONBytes = 32 * 1024
+)
 
 func claimNext(options Options) gin.HandlerFunc {
 	return func(context *gin.Context) {
@@ -35,7 +38,16 @@ func claimNext(options Options) gin.HandlerFunc {
 			context.Status(http.StatusNoContent)
 			return
 		}
-		context.JSON(http.StatusOK, response)
+		if !taskclaim.ValidClaimResponse(response) {
+			context.Status(http.StatusServiceUnavailable)
+			return
+		}
+		encoded, err := json.Marshal(response)
+		if err != nil || len(encoded) > maxClaimResponseJSONBytes {
+			context.Status(http.StatusServiceUnavailable)
+			return
+		}
+		context.Data(http.StatusOK, "application/json; charset=utf-8", encoded)
 	}
 }