nodetube icon indicating copy to clipboard operation
nodetube copied to clipboard

Limit channelName, channel descriptions, and comment sizes (security)

Open mayeaux opened this issue 4 years ago • 1 comments

Someone was doing an exploit with a really long channelName on the user model.

Those values should be sanitized and limited in size for security reasons

mayeaux avatar Dec 27 '20 06:12 mayeaux

What are the limits anyway? EDIT: I assume it's for editing the those values, as the server already checks the sizes on signup at least. EDIT2: @mayeaux Let me guess, the name length didn't get validated, despite the check being in the code, right? If so, the fix is pretty simple, you had to pass the options object with min and max to the len() method instead of just numbers. It's not a full solution, but will enable validation on signup at least.

BassOfBass avatar Dec 27 '20 09:12 BassOfBass