Mirrors/continuwuity
1
0
Fork 0
mirror of https://forgejo.ellis.link/continuwuation/continuwuity.git synced 2026-05-26 20:49:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: Add bounds checking for profile data

Browse Source
This commit is contained in:
Ginger
2026-04-28 09:16:57 -04:00
parent d256a1c1fa
commit 551cf48642
1 changed files with 11 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/api/client/profile.rs
+11 -4
View File
@@ -258,14 +258,19 @@ async fn set_profile_field(
user_id: &UserId, user_id: &UserId,
change: ProfileFieldChange, change: ProfileFieldChange,
) -> Result<()> { ) -> Result<()> {
const MAX_KEY_LENGTH_BYTES: usize = 255;
const MAX_PROFILE_LENGTH_BYTES: usize = 65536;
let field_name = change.field_name(); let field_name = change.field_name();
// TODO: The spec mentions special error codes (M_PROFILE_TOO_LARGE, // TODO: The spec mentions special error codes (M_PROFILE_TOO_LARGE,
// M_KEY_TOO_LARGE) for profile field size limits, but they're not in its list // M_KEY_TOO_LARGE) for profile field size limits, but they're not in its list
// of error codes and Ruma doesn't have them. Should we return those, or is // of error codes and Ruma doesn't have them. Should we return those, or is
// M_TOO_LARGE okay? // M_TOO_LARGE okay?
if field_name.as_str().len() > 255 { if field_name.as_str().len() > MAX_KEY_LENGTH_BYTES {
return Err!(Request(TooLarge("Individual profile keys must not exceed 255 bytes."))); return Err!(Request(TooLarge(
"Individual profile keys must not exceed {MAX_KEY_LENGTH_BYTES} bytes in length."
)));
} }
// Serialize the entire profile as canonical JSON, including the new change, // Serialize the entire profile as canonical JSON, including the new change,
@@ -288,9 +293,11 @@ async fn set_profile_field(
if let Ok(canonical_profile) = to_canonical_object(full_profile) { if let Ok(canonical_profile) = to_canonical_object(full_profile) {
if serde_json::to_string(&canonical_profile) if serde_json::to_string(&canonical_profile)
.expect("should be able to serialize to string") .expect("should be able to serialize to string")
.len() > 65536 .len() > MAX_PROFILE_LENGTH_BYTES
{ {
return Err!("Profile data must not exceed 64KiB in size."); return Err!(
"Profile data must not exceed {MAX_PROFILE_LENGTH_BYTES} bytes in length."
);
} }
} else { } else {
return Err!(Request(BadJson("Failed to canonicalize profile."))); return Err!(Request(BadJson("Failed to canonicalize profile.")));