tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Limit a story to 64 KB before HTML Purifier runs.

Browse Source 
A preview purified any posted story, even without a token or a captcha. A few megabytes took seconds and hundreds of megabytes.
This commit is contained in:
tim
2026-09-26 15:27:51 +02:00
parent bf36ec25fd
commit ed6f98e0ac
4 changed files with 31 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/php/Unit/DisplayStoriesTest.php
+9
View File
@@ -111,6 +111,15 @@ class DisplayStoriesTest extends TestCase {
$this->assertStringNotContainsString('x()', $page);
}
// HTML Purifier needs seconds for a few megabytes, so a posted story over the limit is not shown
public function testPreviewDoesNotShowATooLongStory(): void {
$GLOBALS['action'] = 'preview';
$this->request(array(), array('title' => 'Long', 'author' => 'Me', 'story' => '<p><b>x</b></p>' . str_repeat('a', 65536)));
$page = display_stories();
$this->assertStringContainsString('<p>The story is too long to show.</p>', $page);
$this->assertStringNotContainsString('<b>x</b>', $page);
}
public function testPreviewShowsAPendingImage(): void {
$GLOBALS['action'] = 'preview';
$GLOBALS['file_src'] = '/display?pending="><script>';
tests/php/Unit/ValidateDataTest.php
+6
View File
@@ -35,6 +35,12 @@ class ValidateDataTest extends TestCase {
$this->assertSame(array(), $this->validate(array('remove_img' => '1')));
}
public function testATooLongStoryIsRefused(): void {
$this->assertSame(array(), $this->validate(array('story' => str_repeat('a', 65536))));
$this->assertSame(array('story' => 'The story is too long. Please shorten it.'),
$this->validate(array('story' => str_repeat('a', 65537))));
}
public function testVisitorsNeedTheCaptcha(): void {
FakeRecaptcha::install('{"tokenProperties":{"valid":false}}');
$this->assertSame(array('captcha' => 'Please complete the captcha.'), $this->validate(array('g-recaptcha-response' => 'r'), FALSE));