How to handle malicious queries that can crash zoekt webserver?

[rajputa-deshaw]

I wanted to ask what is the recommended way to handle malicious queries which can crash the zoekt webserver. An example is a very large query containing "( ( ( ...." repeated several times. Two ways in which this can be handled for our use case are:

1. Parse the query before sending it to zoekt, blocking any malicious query.
2. Add a maximum recursion depth in the parser in our internal fork of zoekt.

Fix 1 involves a lot more work than fix 2 but fix 2 increases the drift between upstream zoekt and our fork.