claude code review changes

mux.go

@@ -23,6 +23,22 @@ func New() *Mux {
 		mux:    http.NewServeMux(),
 		routes: new(RouteList),
 	}
+
+	// Catch-all OPTIONS handler.
+	// Pass it through all middlewares and drain oversized bodies.
+	m.OPTIONS("/", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Length", "0")
+		if r.ContentLength != 0 {
+			// Read up to 4KB of OPTIONS body (as mentioned in the
+			// spec as being reserved for future use), but anything
+			// over that is considered a waste of server resources
+			// (or an attack) and we abort and close the connection,
+			// courtesy of MaxBytesReader's EOF behavior.
+			mb := http.MaxBytesReader(w, r.Body, 4<<10)
+			_, _ = io.Copy(io.Discard, mb)
+		}
+	})
+
 	return m
 }
 
@@ -147,8 +163,8 @@ func (m *Mux) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 
 func (m *Mux) PrintRoutes(w io.Writer) {
 	for _, route := range m.routes.All() {
-		w.Write([]byte(route))
-		w.Write([]byte("\n"))
+		_, _ = w.Write([]byte(route))
+		_, _ = w.Write([]byte("\n"))
 	}
 }