Address CodeRabbit review feedback

- raster.py: cap `**` in band math. The AST allowlist permitted ast.Pow with
  no bound, so `9**9**6` or `9**999999` built a multi-megabyte exact integer
  and pinned a core for tens of seconds before the post-eval shape check could
  reject it. An exponent must now be a numeric literal within MAX_POW_EXPONENT
  (64, far past squares/gamma/roots) unless it derives from a band or curated
  call, where NumPy's element-wise float power is bounded by the raster shape.
- tests/test_raster.py: cover chained (`9**9**6`), oversized (`9**999999`),
  and computed (`9 ** (500 * 500)`) exponents, plus a positive case asserting
  ordinary powers including a negative literal exponent still evaluate.

Author: giswqs

backend/geolibre_server/geolibre_server/app/raster.py

@@ -1066,6 +1066,13 @@ def load_bands(path, letter, namespace, base):
     ast.GtE,
     ast.keyword,
 )
+# ``**`` on two plain integers stays exact, so ``9**9**6`` builds a
+# half-million-digit result and pins a core for tens of seconds before the shape
+# check can reject it. Require the exponent to be a small numeric literal unless
+# it derives from a band or a curated call, whose element-wise float power is
+# bounded by the raster's shape. 64 is far past anything band math needs
+# (squares, gamma, roots).
+MAX_POW_EXPONENT = 64
 for node in ast.walk(tree):
     if not isinstance(node, _allowed_nodes):
         raise SystemExit(
@@ -1077,6 +1084,24 @@ def load_bands(path, letter, namespace, base):
             "Expression may only use numeric constants "
             "(band math only allows curated functions and operators)"
         )
+    if isinstance(node, ast.BinOp) and isinstance(node.op, ast.Pow):
+        exponent = node.right
+        while isinstance(exponent, ast.UnaryOp):
+            exponent = exponent.operand
+        band_backed = any(
+            isinstance(inner, (ast.Name, ast.Call)) for inner in ast.walk(exponent)
+        )
+        if not band_backed:
+            if not isinstance(exponent, ast.Constant):
+                raise SystemExit(
+                    "Exponent must be a plain number or derive from a band "
+                    f"(band math caps '**' at {MAX_POW_EXPONENT})"
+                )
+            if abs(exponent.value) > MAX_POW_EXPONENT:
+                raise SystemExit(
+                    f"Exponent may not exceed {MAX_POW_EXPONENT} "
+                    "(band math caps '**' to keep evaluation bounded)"
+                )
     if isinstance(node, ast.Call):
         # ``np.where(...)`` / ``A.tofile(...)`` parse as Attribute-backed calls;
         # Attribute is already rejected above, but keep an explicit Name check.

backend/geolibre_server/tests/test_raster.py

@@ -1093,3 +1093,61 @@ def test_raster_calculator_rejects_unbounded_allocations(tmp_path: Path) -> None
         combined = completed.stdout + completed.stderr
         assert "may not use" in combined or "numeric constants" in combined, expression
         assert not out.exists()
+
+
+@requires_rasterio
+def test_raster_calculator_rejects_runaway_exponents(tmp_path: Path) -> None:
+    """Chained or oversized ``**`` must be refused before eval computes a bignum."""
+    src = _write_dem(tmp_path / "dem.tif")
+    out = tmp_path / "calc.tif"
+    for expression in (
+        "A + 9**9**6",
+        "A + 9**999999",
+        "A + 9 ** (500 * 500)",
+    ):
+        completed = subprocess.run(
+            [
+                sys.executable,
+                "-c",
+                _RASTER_TOOL_SCRIPTS["raster-calc"],
+                json.dumps(
+                    {
+                        "input_path": str(src),
+                        "output_path": str(out),
+                        "expression": expression,
+                    }
+                ),
+            ],
+            check=False,
+            capture_output=True,
+            text=True,
+            timeout=60,
+        )
+        assert completed.returncode != 0, expression
+        combined = completed.stdout + completed.stderr
+        assert "Exponent" in combined, expression
+        assert not out.exists()
+
+
+@requires_rasterio
+def test_raster_calculator_allows_ordinary_exponents(tmp_path: Path) -> None:
+    """The ``**`` cap must not disturb the small powers band math actually uses."""
+    import numpy as np
+    import rasterio
+
+    src = _write_dem(tmp_path / "dem.tif")  # band 1 = x + y
+    out = tmp_path / "calc.tif"
+    _run_script(
+        _RASTER_TOOL_SCRIPTS["raster-calc"],
+        {
+            "input_path": str(src),
+            "output_path": str(out),
+            # A negative literal exponent must survive the unary-sign strip.
+            "expression": "(A ** 2) ** 0.5 * 2 ** -2",
+        },
+    )
+    with rasterio.open(src) as ds:
+        a = ds.read(1).astype("float64")
+    with rasterio.open(out) as ds:
+        result = ds.read(1).astype("float64")
+    assert np.allclose(result, (a**2) ** 0.5 * 0.25, atol=1e-4)