github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2024-12-04 04:43:39 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: Check the length of raw post body (#19734)

Browse Source 
Co-authored-by: Jarek Radosz <jradosz@gmail.com>
This commit is contained in:
Alan Guo Xiang Tan 2023-01-05 08:51:21 +08:00 committed by GitHub
parent 66ab2d71ff
commit b9e2e997f4
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 23 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
lib/validators/stripped_length_validator.rb
View File

@ -2,12 +2,16 @@
class StrippedLengthValidator < ActiveModel::EachValidator class StrippedLengthValidator < ActiveModel::EachValidator
def self.validate(record, attribute, value, range) def self.validate(record, attribute, value, range)
if !value.nil? if value.nil?
value = get_sanitized_value(value) record.errors.add attribute, I18n.t('errors.messages.blank')
record.errors.add attribute, (I18n.t('errors.messages.too_short', count: range.begin)) if value.length < range.begin elsif value.length > range.end
record.errors.add attribute, (I18n.t('errors.messages.too_long_validation', max: range.end, length: value.length)) if value.length > range.end record.errors.add attribute, I18n.t('errors.messages.too_long_validation', max: range.end, length: value.length)
else else
record.errors.add attribute, (I18n.t('errors.messages.blank')) value = get_sanitized_value(value)
if value.length < range.begin
record.errors.add attribute, I18n.t('errors.messages.too_short', count: range.begin)
end
end end
end end

14
spec/requests/posts_controller_spec.rb
View File

@ -975,6 +975,20 @@ describe PostsController do
parsed = response.parsed_body parsed = response.parsed_body
expect(parsed["action"]).not_to eq("enqueued") expect(parsed["action"]).not_to eq("enqueued")
end end
it "doesn't enqueue replies when the post is too long (including a html comment)" do
SiteSetting.max_post_length = 10
raw = "A post <!-- " + ("a" * 3000) + "-->"
post "/posts.json", params: {
raw: raw,
title: "this is the test title for the topic"
}
expect(response).not_to be_successful
parsed = response.parsed_body
expect(parsed["action"]).not_to eq("enqueued")
end
end end
it 'silences correctly based on auto_silence_first_post_regex' do it 'silences correctly based on auto_silence_first_post_regex' do