From baf9bf82c9fb506c08523384fb8ef59bddfe29f9 Mon Sep 17 00:00:00 2001 From: Nadav Tasher Date: Wed, 8 Jan 2025 16:32:39 +0200 Subject: [PATCH] Bugfix - Enforce URL length check in LinkMetadata before attempting to insert to database (#29589) * Add missing URL length validation in LinkMetadata * Added MaxURLLength constant * Add test to validate new URL length limit * Add comment about table constraint * Use a seperate error string for URL length errors * Added error string fpr URL length * Updated error message * Update en.json * Fixed gofmt error in link_metadata.go * use right txn id ```release-note NONE ``` --------- Co-authored-by: Agniva De Sarker Co-authored-by: Mattermost Build --- server/i18n/en.json | 4 ++++ server/public/model/link_metadata.go | 5 +++++ server/public/model/link_metadata_test.go | 10 ++++++++++ 3 files changed, 19 insertions(+) diff --git a/server/i18n/en.json b/server/i18n/en.json index f4455fb62d..4905edc9bd 100644 --- a/server/i18n/en.json +++ b/server/i18n/en.json @@ -9520,6 +9520,10 @@ "id": "model.link_metadata.is_valid.url.app_error", "translation": "Link metadata URL must be set." }, + { + "id": "model.link_metadata.is_valid.url_length.app_error", + "translation": "Length of link metadata URL is {{ .Length }} characters long, which exceeds the maximum limit of {{ .MaxLength }} characters." + }, { "id": "model.member.is_valid.channel.app_error", "translation": "Channel name is not valid" diff --git a/server/public/model/link_metadata.go b/server/public/model/link_metadata.go index 56f2a8640d..4c53784e20 100644 --- a/server/public/model/link_metadata.go +++ b/server/public/model/link_metadata.go @@ -21,6 +21,7 @@ const ( LinkMetadataTypeNone LinkMetadataType = "none" LinkMetadataTypeOpengraph LinkMetadataType = "opengraph" LinkMetadataMaxImages int = 5 + LinkMetadataMaxURLLength int = 2048 // Maximum URL length in LinkMetadata table ) type LinkMetadataType string @@ -93,6 +94,10 @@ func (o *LinkMetadata) IsValid() *AppError { return NewAppError("LinkMetadata.IsValid", "model.link_metadata.is_valid.url.app_error", nil, "", http.StatusBadRequest) } + if len(o.URL) > LinkMetadataMaxURLLength { + return NewAppError("LinkMetadata.IsValid", "model.link_metadata.is_valid.url_length.app_error", map[string]any{"MaxLength": LinkMetadataMaxURLLength, "Length": len(o.URL)}, "", http.StatusBadRequest) + } + if o.Timestamp == 0 || !isRoundedToNearestHour(o.Timestamp) { return NewAppError("LinkMetadata.IsValid", "model.link_metadata.is_valid.timestamp.app_error", nil, "", http.StatusBadRequest) } diff --git a/server/public/model/link_metadata_test.go b/server/public/model/link_metadata_test.go index 4d8b8bcec5..af702a34a7 100644 --- a/server/public/model/link_metadata_test.go +++ b/server/public/model/link_metadata_test.go @@ -146,6 +146,16 @@ func TestLinkMetadataIsValid(t *testing.T) { }, Expected: false, }, + { + Name: "should be invalid because of URL length being too long", + Metadata: &LinkMetadata{ + URL: "http://example.com/?" + strings.Repeat("a", 2048), + Timestamp: 1546300800000, + Type: LinkMetadataTypeImage, + Data: &PostImage{}, + }, + Expected: false, + }, } { t.Run(test.Name, func(t *testing.T) { appErr := test.Metadata.IsValid()