Go: JSON を r.Body から直接デコードする前に http.MaxBytesReader で上限を付ける

func handler(w http.ResponseWriter, r *http.Request) {
    r.Body = http.MaxBytesReader(w, r.Body, 1<<20) // 1 MiB

    var in Input
    if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
        var mbe *http.MaxBytesError
        if errors.As(err, &mbe) {
            http.Error(w, "request body too large", http.StatusRequestEntityTooLarge) // 413
            return
        }
        http.Error(w, "bad request", http.StatusBadRequest)
        return
    }
    // ...
}