github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-24 03:36:18 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: Limit chat message char length (#19207)

Browse Source 
Only allow maximum of 6000 characters for chat messages when they
are created or edited. A hidden setting can control this limit,
6000 is the default.

There is also a migration here to truncate any existing messages to
6000 characters if the message is already over that and if the
chat_messages table exists. We also set cooked_version to NULL
for those messages so we can identify them for rebake.
This commit is contained in:
Martin Brennan
2022-11-28 10:48:30 +10:00
committed by GitHub
parent a71f6cf09b
commit 3de765c895
8 changed files with 99 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
plugins/chat/app/controllers/incoming_chat_webhooks_controller.rb
View File

@ -1,7 +1,6 @@
# frozen_string_literal: true
class Chat::IncomingChatWebhooksController < ApplicationController
WEBHOOK_MAX_MESSAGE_LENGTH = 2000
WEBHOOK_MESSAGES_PER_MINUTE_LIMIT = 10
skip_before_action :verify_authenticity_token, :redirect_to_login_if_required
@ -80,9 +79,9 @@ class Chat::IncomingChatWebhooksController < ApplicationController
end
def validate_message_length(message)
return if message.length <= WEBHOOK_MAX_MESSAGE_LENGTH
return if message.length <= SiteSetting.chat_maximum_message_length
raise Discourse::InvalidParameters.new(
"Body cannot be over #{WEBHOOK_MAX_MESSAGE_LENGTH} characters",
"Body cannot be over #{SiteSetting.chat_maximum_message_length} characters",
)
end