Skip to content

feat(state): cap name lengths on peer-supplied mutations (closes #189)#367

Merged
intendednull merged 1 commit into
mainfrom
claude/audit-fix-issue-189-name-length-caps
Apr 25, 2026
Merged

feat(state): cap name lengths on peer-supplied mutations (closes #189)#367
intendednull merged 1 commit into
mainfrom
claude/audit-fix-issue-189-name-length-caps

Conversation

@intendednull
Copy link
Copy Markdown
Owner

Reject CreateChannel / RenameChannel / RenameServer when name exceeds 100 chars, and SetProfile when display_name exceeds 64 chars. Uses .chars().count() so multi-byte graphemes aren't bypassed by byte-length comparisons. Adds a UTF-8 awareness test using crab emoji.

Closes #189


Generated by Claude Code

Reject CreateChannel/RenameChannel/RenameServer when name >100 chars
and SetProfile when display_name >64 chars. Counts UTF-8 chars, not
bytes, so multi-byte graphemes aren't bypassed by .len() comparisons.

Closes #189
@intendednull intendednull merged commit f8b2c85 into main Apr 25, 2026
5 checks passed
@intendednull intendednull deleted the claude/audit-fix-issue-189-name-length-caps branch April 25, 2026 18:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[security] No length validation on peer-supplied names enables DoS via oversized strings

2 participants