fix(comment): add validation check for the max comment length

Resolves https://vikunja.sentry.io/issues/6441922105/events/245b8f1de3e64951a108e2f6cb654c58/
This commit is contained in:
kolaente
2025-03-23 18:03:29 +01:00
parent 4e504c288e
commit bbd9d0d0b3
2 changed files with 22 additions and 4 deletions

View File

@@ -20,7 +20,6 @@ import (
"time"
"code.vikunja.io/api/pkg/db"
"code.vikunja.io/api/pkg/events"
"code.vikunja.io/api/pkg/user"
"code.vikunja.io/api/pkg/web"
@@ -32,7 +31,7 @@ import (
// TaskComment represents a task comment
type TaskComment struct {
ID int64 `xorm:"autoincr pk unique not null" json:"id" param:"commentid"`
Comment string `xorm:"text not null" json:"comment"`
Comment string `xorm:"text not null" json:"comment" valid:"dbtext,required"`
AuthorID int64 `xorm:"not null" json:"-"`
Author *user.User `xorm:"-" json:"author"`
TaskID int64 `xorm:"not null" json:"-" param:"task"`

View File

@@ -17,6 +17,9 @@
package routes
import (
"strings"
"code.vikunja.io/api/pkg/config"
"code.vikunja.io/api/pkg/models"
"github.com/asaskevich/govalidator"
@@ -26,9 +29,25 @@ import (
type CustomValidator struct{}
func init() {
govalidator.TagMap["time"] = govalidator.Validator(func(str string) bool {
govalidator.TagMap["time"] = func(str string) bool {
return govalidator.IsTime(str, "15:04")
})
}
// Custom validator for database TEXT fields that adapts to the database being used
govalidator.TagMap["dbtext"] = func(str string) bool {
// Get the current database dialect
dialect := strings.ToLower(config.DatabaseType.GetString())
// Default limit for MySQL and unknown databases (65KB safely under TEXT limit)
maxLength := 65000
// For databases that support larger text fields
if dialect == "postgres" || dialect == "sqlite" || dialect == "sqlite3" {
maxLength = 1048576 // ~1MB limit for PostgreSQL and SQLite
}
return len(str) <= maxLength
}
}
// Validate validates stuff