tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Limit a story to 64 KB before HTML Purifier runs.

Browse Source 
A preview purified any posted story, even without a token or a captcha. A few megabytes took seconds and hundreds of megabytes.
This commit is contained in:
tim
2026-09-26 15:27:51 +02:00
parent bf36ec25fd
commit ed6f98e0ac
4 changed files with 31 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/php/Unit/ValidateDataTest.php
+6
View File
@@ -35,6 +35,12 @@ class ValidateDataTest extends TestCase {
$this->assertSame(array(), $this->validate(array('remove_img' => '1')));
}
public function testATooLongStoryIsRefused(): void {
$this->assertSame(array(), $this->validate(array('story' => str_repeat('a', 65536))));
$this->assertSame(array('story' => 'The story is too long. Please shorten it.'),
$this->validate(array('story' => str_repeat('a', 65537))));
}
public function testVisitorsNeedTheCaptcha(): void {
FakeRecaptcha::install('{"tokenProperties":{"valid":false}}');
$this->assertSame(array('captcha' => 'Please complete the captcha.'), $this->validate(array('g-recaptcha-response' => 'r'), FALSE));