Return 400 bad request codes for webhooks when attachment or text is too long (#4879)

api/webhook.go

@@ -7,6 +7,7 @@ import (
 	"io"
 	"net/http"
 	"strings"
+	"unicode/utf8"
 
 	l4g "github.com/alecthomas/log4go"
 	"github.com/gorilla/mux"
@@ -387,18 +388,35 @@ func incomingWebhook(c *Context, w http.ResponseWriter, r *http.Request) {
 	text := parsedRequest.Text
 	if len(text) == 0 && parsedRequest.Attachments == nil {
 		c.Err = model.NewLocAppError("incomingWebhook", "web.incoming_webhook.text.app_error", nil, "")
+		c.Err.StatusCode = http.StatusBadRequest
+		return
+	}
+
+	textSize := utf8.RuneCountInString(text)
+	if textSize > model.POST_MESSAGE_MAX_RUNES {
+		c.Err = model.NewLocAppError("incomingWebhook", "web.incoming_webhook.text.length.app_error", map[string]interface{}{"Max": model.POST_MESSAGE_MAX_RUNES, "Actual": textSize}, "")
+		c.Err.StatusCode = http.StatusBadRequest
 		return
 	}
 
 	channelName := parsedRequest.ChannelName
 	webhookType := parsedRequest.Type
 
-	//attachments is in here for slack compatibility
+	// attachments is in here for slack compatibility
 	if parsedRequest.Attachments != nil {
 		if len(parsedRequest.Props) == 0 {
 			parsedRequest.Props = make(model.StringInterface)
 		}
 		parsedRequest.Props["attachments"] = parsedRequest.Attachments
+
+		attachmentSize := utf8.RuneCountInString(model.StringInterfaceToJson(parsedRequest.Props))
+		// Minus 100 to leave room for setting post type in the Props
+		if attachmentSize > model.POST_PROPS_MAX_RUNES-100 {
+			c.Err = model.NewLocAppError("incomingWebhook", "web.incoming_webhook.attachment.app_error", map[string]interface{}{"Max": model.POST_PROPS_MAX_RUNES - 100, "Actual": attachmentSize}, "")
+			c.Err.StatusCode = http.StatusBadRequest
+			return
+		}
+
 		webhookType = model.POST_SLACK_ATTACHMENT
 	}