Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Flag message length is not validated at all #1289

Open
Oaphi opened this issue Jan 7, 2024 · 0 comments
Open

Flag message length is not validated at all #1289

Oaphi opened this issue Jan 7, 2024 · 0 comments
Assignees
Labels
area: ruby Changes to server-side code complexity: average Not particularly hard, not particularly trivial. priority: low type: bug Something isn't working

Comments

@Oaphi
Copy link
Member

Oaphi commented Jan 7, 2024

Describe the bug

Length of flag messages is not validated server-side (although the minimum length [1 char ATTOW] is validated client-side). As a result, flaggers can submit up to 65 536 characters.

To Reproduce
Steps to reproduce the behavior:

  1. Log in as any user.
  2. Flag any post with a custom reason.
    Include as many characters as you like.
    Observe the flag successfully being submitted or a raw DB error when over 65536 chars.

As per prior discussion, the upper limit should be configurable per-community with 1000 chars as the default. Let's also make the lower limit configurable (it's hardcoded right now) with the default set to 1 (for backwards compatibility).

@Oaphi Oaphi added area: ruby Changes to server-side code type: bug Something isn't working complexity: average Not particularly hard, not particularly trivial. labels Jan 7, 2024
@Oaphi Oaphi self-assigned this Jan 7, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area: ruby Changes to server-side code complexity: average Not particularly hard, not particularly trivial. priority: low type: bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant