Jelajahi Sumber

Add in guard for long messages

James Allen 9 tahun lalu
induk
melakukan
dfe16d28a5

+ 5 - 0
services/chat/app/coffee/Features/Messages/MessageHttpController.coffee

@@ -7,6 +7,7 @@ ThreadManager = require "../Threads/ThreadManager"
 
 module.exports = MessageHttpController =
 	DEFAULT_MESSAGE_LIMIT: 50
+	MAX_MESSAGE_LENGTH: 10 * 1024 # 10kb, about 1,500 words
 	
 	getGlobalMessages: (req, res, next) ->
 		MessageHttpController._getMessages(ThreadManager.GLOBAL_THREAD, req, res, next)
@@ -76,6 +77,10 @@ module.exports = MessageHttpController =
 		{project_id} = req.params
 		if !ObjectId.isValid(user_id)
 			return res.send(400, "Invalid user_id")
+		if !content?
+			return res.send(400, "No content provided")
+		if content.length > @MAX_MESSAGE_LENGTH
+			return res.send(400, "Content too long (> #{@MAX_MESSAGE_LENGTH} bytes)")
 		logger.log {client_thread_id, project_id, user_id, content}, "new message received"
 		ThreadManager.findOrCreateThread project_id, client_thread_id, (error, thread) ->
 			return next(error) if error?

+ 15 - 0
services/chat/test/acceptance/coffee/SendingAMessageTests.coffee

@@ -66,4 +66,19 @@ describe "Sending a message", ->
 			ChatClient.sendMessage @project_id, "malformed-thread-id", @user_id, "content", (error, response, body) =>
 				expect(response.statusCode).to.equal 400
 				expect(body).to.equal "Invalid thread_id"
+				done()
+	
+	describe "with no content", ->
+		it "should return a graceful error", (done) ->
+			ChatClient.sendMessage @project_id, @thread_id, @user_id, null, (error, response, body) =>
+				expect(response.statusCode).to.equal 400
+				expect(body).to.equal "No content provided"
+				done()
+	
+	describe "with very long content", ->
+		it "should return a graceful error", (done) ->
+			content = new Buffer(10240).toString("hex")
+			ChatClient.sendMessage @project_id, @thread_id, @user_id, content, (error, response, body) =>
+				expect(response.statusCode).to.equal 400
+				expect(body).to.equal "Content too long (> 10240 bytes)"
 				done()