tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Limit a story to 64 KB before HTML Purifier runs.

Browse Source 
A preview purified any posted story, even without a token or a captcha. A few megabytes took seconds and hundreds of megabytes.
This commit is contained in:
tim
2026-09-26 15:27:51 +02:00
parent bf36ec25fd
commit ed6f98e0ac
4 changed files with 31 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/php/Unit/DisplayStoriesTest.php
+9
View File
@@ -111,6 +111,15 @@ class DisplayStoriesTest extends TestCase {
$this->assertStringNotContainsString('x()', $page);
}
// HTML Purifier needs seconds for a few megabytes, so a posted story over the limit is not shown
public function testPreviewDoesNotShowATooLongStory(): void {
$GLOBALS['action'] = 'preview';
$this->request(array(), array('title' => 'Long', 'author' => 'Me', 'story' => '<p><b>x</b></p>' . str_repeat('a', 65536)));
$page = display_stories();
$this->assertStringContainsString('<p>The story is too long to show.</p>', $page);
$this->assertStringNotContainsString('<b>x</b>', $page);
}
public function testPreviewShowsAPendingImage(): void {
$GLOBALS['action'] = 'preview';
$GLOBALS['file_src'] = '/display?pending="><script>';