A long user name in "edit user" can break the webserver

[potiuk]

Body

We should limit the allowed payload for parameters (name/ passed to user edit as it might break the webserver.

Once you send really huge payload, the webserver (millions of characters) the webserver might simply render unsable.

Committer

• I acknowledge that I am a maintainer/committer of the Apache Airflow project.

[jedcunningham]

Is this an Airflow issue or a FAB issue?

[potiuk]

IMHO (regardless who is at fault) this is robably something that is easiest to handle by Airflow.

For this kind of isse in general it is probably best to hanle it as early as possible in "POST request" lifetime - either either at the guncorn or flask level - once the data get passed to WTF or FAB it's probably too late.

Likely setting the righ value fo:

app.config['MAX_CONTENT_LENGTH'] = limit_in_mb * 1024 * 1024

Should fix the problem.