Various hardening to REST routes (#1293)

* URL reweriting for static

* request size limits

* improve quotas, make tests work

* remove debugging code

* pass limits to front-end

* fix renaming boggle

server/data_common/data_adaptor.py

@@ -6,7 +6,7 @@ from os.path import basename, splitext
 
 from server.data_common.fbs.matrix import encode_matrix_fbs
 from server.common.constants import Axis, DEFAULT_TOP_N
-from server.common.errors import FilterError, JSONEncodingValueError
+from server.common.errors import FilterError, JSONEncodingValueError, ExceedsLimitError
 from server.compute.diffexp import diffexp_ttest
 from server.common.utils import jsonify_numpy
 from server.common.app_config import AppFeature, AppConfig
@@ -92,6 +92,16 @@ class DataAdaptor(metaclass=ABCMeta):
     def get_obs_columns(self):
         pass
 
+    @abstractmethod
+    def get_obs_keys(self):
+        # return list of keys
+        pass
+
+    @abstractmethod
+    def get_var_keys(self):
+        # return list of keys
+        pass
+
     @abstractmethod
     def cleanup(self):
         pass
@@ -259,6 +269,10 @@ class DataAdaptor(metaclass=ABCMeta):
         if obs_selector is not None:
             raise FilterError("filtering on obs unsupported")
 
+        num_columns = self.get_shape()[1] if var_selector is None else np.count_nonzero(var_selector)
+        if self.config.exceeds_limit("column_request_max", num_columns):
+            raise ExceedsLimitError("Requested dataframe columns exceed column request limit")
+
         X = self.get_X_array(obs_selector, var_selector)
         col_idx = np.nonzero([] if var_selector is None else var_selector)[0]
         return encode_matrix_fbs(X, col_idx=col_idx, row_idx=None)
@@ -286,6 +300,11 @@ class DataAdaptor(metaclass=ABCMeta):
         if top_n is None:
             top_n = DEFAULT_TOP_N
 
+        if self.config.exceeds_limit(
+            "diffexp_cellcount_max", np.count_nonzero(obs_mask_A) + np.count_nonzero(obs_mask_B)
+        ):
+            raise ExceedsLimitError("Diffexp request exceeds max cell count limit")
+
         result = diffexp_ttest(self, obs_mask_A, obs_mask_B, top_n, self.config.diffexp__lfc_cutoff)
 
         try: