[MM-52527] (#23519)

* limit markdown size

server/channels/store/sqlstore/post_store.go

@@ -2552,6 +2552,7 @@ func (s *SqlPostStore) determineMaxPostSize() int {
 }
 
 // GetMaxPostSize returns the maximum number of runes that may be stored in a post.
+// For any changes, accordingly update the markdown maxLen here - markdown/inspect.go.
 func (s *SqlPostStore) GetMaxPostSize() int {
 	s.maxPostSizeOnce.Do(func() {
 		s.maxPostSizeCached = s.determineMaxPostSize()

server/public/shared/markdown/inspect.go

@@ -3,9 +3,18 @@
 
 package markdown
 
+const (
+	// Assuming 64k maxSize of a post which can be stored in DB.
+	// Allow scanning upto twice(arbitrary value) the post size.
+	maxLen = 1024 * 64 * 2
+)
+
 // Inspect traverses the markdown tree in depth-first order. If f returns true, Inspect invokes f
 // recursively for each child of the block or inline, followed by a call of f(nil).
 func Inspect(markdown string, f func(any) bool) {
+	if len(markdown) > maxLen {
+		return
+	}
 	document, referenceDefinitions := Parse(markdown)
 	InspectBlock(document, func(block Block) bool {
 		if !f(block) {

server/public/shared/markdown/inspect_test.go

@@ -12,6 +12,7 @@ import (
 )
 
 func TestInspect(t *testing.T) {
+	t.Run("base", func(t *testing.T) {
 		markdown := `
 [foo]: bar
 - a
@@ -51,6 +52,45 @@ func TestInspect(t *testing.T) {
 			"            Paragraph",
 			"                Text",
 		}, visited)
+	})
+
+	t.Run("visit nodes when len is smaller than maxLen", func(t *testing.T) {
+		n := maxLen / 5
+		markdown := strings.Repeat(`![`, n) + strings.Repeat(`]()`, n)
+
+		visited := []string{}
+		level := 0
+		Inspect(markdown, func(blockOrInline any) bool {
+			if blockOrInline == nil {
+				level--
+			} else {
+				visited = append(visited, strings.Repeat(" ", level*4)+strings.TrimPrefix(fmt.Sprintf("%T", blockOrInline), "*markdown."))
+				level++
+			}
+			return true
+		})
+
+		assert.NotEmpty(t, visited)
+	})
+
+	t.Run("do not visit any nodes when len is greater than maxLen", func(t *testing.T) {
+		n := (maxLen / 5) + 1
+		markdown := strings.Repeat(`![`, n) + strings.Repeat(`]()`, n)
+
+		visited := []string{}
+		level := 0
+		Inspect(markdown, func(blockOrInline any) bool {
+			if blockOrInline == nil {
+				level--
+			} else {
+				visited = append(visited, strings.Repeat(" ", level*4)+strings.TrimPrefix(fmt.Sprintf("%T", blockOrInline), "*markdown."))
+				level++
+			}
+			return true
+		})
+
+		assert.Empty(t, visited)
+	})
 }
 
 var counterSink int