limit message length

coder · mafredri · Jul 11, 2023 · Jul 6, 2023 · Jul 6, 2023 · Jul 6, 2023
commit 5bee51f3a75d8c78446480f6adb785ee5ef64179
diff --git a/coderd/database/dbfake/dbfake.go b/coderd/database/dbfake/dbfake.go
@@ -3921,6 +3921,10 @@ func (q *fakeQuerier) InsertTemplateVersion(_ context.Context, arg database.Inse
 		return database.TemplateVersion{}, err
 	}
 
+	if len(arg.Message) > 1048576 {
+		return database.TemplateVersion{}, xerrors.New("message too long")
+	}
+
 	q.mutex.Lock()
 	defer q.mutex.Unlock()
 

diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
diff --git a/coderd/database/migrations/000135_add_template_version_message.up.sql b/coderd/database/migrations/000135_add_template_version_message.up.sql
@@ -1,3 +1,3 @@
-ALTER TABLE template_versions ADD COLUMN message text NOT NULL DEFAULT '';
+ALTER TABLE template_versions ADD COLUMN message varchar(1048576) NOT NULL DEFAULT '';
 
 COMMENT ON COLUMN template_versions.message IS 'Message describing the changes in this version of the template, similar to a Git commit message. Like a commit message, this should be a short, high-level description of the changes in this version of the template. This message is immutable and should not be updated after the fact.';
diff --git a/coderd/templateversions_test.go b/coderd/templateversions_test.go
@@ -5,6 +5,7 @@ import (
 	"context"
 	"net/http"
 	"regexp"
+	"strings"
 	"testing"
 
 	"github.com/google/uuid"
@@ -51,6 +52,26 @@ func TestTemplateVersion(t *testing.T) {
 		assert.Equal(t, "first try", tv.Message)
 	})
 
+	t.Run("Message limit exceeded", func(t *testing.T) {
+		t.Parallel()
+		client, _, _ := coderdtest.NewWithAPI(t, nil)
+		user := coderdtest.CreateFirstUser(t, client)
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+
+		file, err := client.Upload(ctx, codersdk.ContentTypeTar, bytes.NewReader([]byte{}))
+		require.NoError(t, err)
+		_, err = client.CreateTemplateVersion(ctx, user.OrganizationID, codersdk.CreateTemplateVersionRequest{
+			Name:          "bananas",
+			Message:       strings.Repeat("a", 1048577),
+			StorageMethod: codersdk.ProvisionerStorageMethodFile,
+			FileID:        file.ID,
+			Provisioner:   codersdk.ProvisionerTypeEcho,
+		})
+		require.Error(t, err, "message too long, create should fail")
+	})
+
 	t.Run("MemberCanRead", func(t *testing.T) {
 		t.Parallel()
 

diff --git a/codersdk/organizations.go b/codersdk/organizations.go
@@ -43,7 +43,7 @@ type OrganizationMember struct {
 // CreateTemplateVersionRequest enables callers to create a new Template Version.
 type CreateTemplateVersionRequest struct {
 	Name    string `json:"name,omitempty" validate:"omitempty,template_version_name"`
-	Message string `json:"message,omitempty"`
+	Message string `json:"message,omitempty" validate:"lt=1048577"` // Database limit: 1048576.
 	// TemplateID optionally associates a version with a template.
 	TemplateID      uuid.UUID                `json:"template_id,omitempty" format:"uuid"`
 	StorageMethod   ProvisionerStorageMethod `json:"storage_method" validate:"oneof=file,required" enums:"file"`