fix(zarinhub): limit upstream response size

backend/internal/zarinhub/client.go

@@ -13,6 +13,8 @@ import (
 	"card-to-iban/internal/service"
 )
 
+const maxResponseBodySize = 1 << 20
+
 type Client struct {
 	httpClient  *http.Client
 	endpointURL string
@@ -95,7 +97,9 @@ func (c *Client) Convert(
 		UpstreamHTTPStatus: resp.StatusCode,
 	}
 
-	body, err := io.ReadAll(resp.Body)
+	body, err := io.ReadAll(
+		io.LimitReader(resp.Body, maxResponseBodySize+1),
+	)
 	if err != nil {
 		return result,
 			fmt.Errorf(
@@ -105,6 +109,14 @@ func (c *Client) Convert(
 			)
 	}
 
+	if len(body) > maxResponseBodySize {
+		return result,
+			fmt.Errorf(
+				"%w: response body is too large",
+				ErrInvalidResponse,
+			)
+	}
+
 	result.RawResponse = body
 
 	switch {