fix: Add SQL output length limits to prevent DoS (fixes #33)

[richardwooding]

Summary

This PR addresses issue #33 by implementing SQL output length limits to prevent Denial of Service attacks through resource exhaustion from extremely large SQL output.

Changes

Core Implementation

• Added defaultMaxSQLOutputLength = 50000 constant - Default limit for generated SQL
• Added WithMaxOutputLength() option - Allows customization of output length limit
• Implemented output length check in visit() method - Validates SQL length at each recursion point
• Updated both Convert() and ConvertParameterized() - Both respect the output length limit

Tests (output_length_test.go)

Comprehensive test coverage including:

• ✅ Default and custom output length limits
• ✅ Combination with other options (context, schemas, logger, maxDepth)
• ✅ Error message validation
• ✅ Counter reset between calls
• ✅ Large arrays, string concatenations, comprehensions
• ✅ Parameterized query support

Documentation

• Updated CLAUDE.md with new "Resource Exhaustion Protection" section
• Updated README.md security features to include SQL output length limits
• Added usage examples for WithMaxOutputLength()

Security Impact

• Prevents: DoS attacks via extremely large SQL output
• Addresses: CWE-400 (Uncontrolled Resource Consumption)
• Severity: Medium (as noted in issue No Input Length Limits on CEL Expressions Enables DoS #33)
• Default Limit: 50,000 characters (configurable via WithMaxOutputLength())

Example Usage

// Use default limit (50,000 chars)
sql, err := cel2sql.Convert(ast)

// Custom output length limit
sql, err := cel2sql.Convert(ast,
    cel2sql.WithMaxOutputLength(100000))

// Combine with other options
sql, err := cel2sql.Convert(ast,
    cel2sql.WithMaxOutputLength(25000),
    cel2sql.WithMaxDepth(75),
    cel2sql.WithContext(ctx),
    cel2sql.WithSchemas(schemas))

Testing

• ✅ All tests pass (make test)
• ✅ Code passes linting (make lint)
• ✅ Coverage maintained at 90%+
• ✅ No breaking changes

Related Issue

Fixes #33

🤖 Generated with Claude Code

Co-Authored-By: Claude noreply@anthropic.com