Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Limit channelName, channel descriptions, and comment sizes (security) #396

Open
mayeaux opened this issue Dec 27, 2020 · 1 comment
Open

Comments

@mayeaux
Copy link
Owner

mayeaux commented Dec 27, 2020

Someone was doing an exploit with a really long channelName on the user model.

Those values should be sanitized and limited in size for security reasons

@BassOfBass
Copy link
Collaborator

BassOfBass commented Dec 27, 2020

What are the limits anyway?
EDIT: I assume it's for editing the those values, as the server already checks the sizes on signup at least.
EDIT2:
@mayeaux Let me guess, the name length didn't get validated, despite the check being in the code, right? If so, the fix is pretty simple, you had to pass the options object with min and max to the len() method instead of just numbers.
It's not a full solution, but will enable validation on signup at least.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants