mirror of
https://github.com/penpot/penpot.git
synced 2026-08-10 14:59:08 +00:00
4f7bb94bb1
Prevent email bombing attacks on the send-user-feedback endpoint by limiting the error-report field to 1MiB and adding climit rate limits: by-profile (1 permit, queue 3) and global (4 permits), configured in climit.edn. Make the schema public so it can be exercised by tests, and add schema validation tests covering the new size limit. AI-assisted-by: qwen3.7-plus
40 lines
1.5 KiB
Clojure
40 lines
1.5 KiB
Clojure
;; This Source Code Form is subject to the terms of the Mozilla Public
|
|
;; License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
;;
|
|
;; Copyright (c) KALEIDOS INC Sucursal en España SL
|
|
|
|
(ns backend-tests.rpc-feedback-test
|
|
(:require
|
|
[app.common.schema :as sm]
|
|
[app.rpc.commands.feedback :as feedback]
|
|
[clojure.test :as t]))
|
|
|
|
(t/deftest send-user-feedback-schema-validation
|
|
(let [schema feedback/schema:send-user-feedback]
|
|
|
|
(t/testing "accepts valid feedback with all fields"
|
|
(let [params {:subject "Test subject"
|
|
:content "Test content"
|
|
:type "bug"
|
|
:error-href "https://example.com/error"
|
|
:error-report "Error details here"}]
|
|
(t/is (sm/valid? schema params))))
|
|
|
|
(t/testing "accepts feedback without optional fields"
|
|
(let [params {:subject "Test subject"
|
|
:content "Test content"}]
|
|
(t/is (sm/valid? schema params))))
|
|
|
|
(t/testing "accepts error-report up to 1MiB"
|
|
(let [params {:subject "Test subject"
|
|
:content "Test content"
|
|
:error-report (apply str (repeat 1048576 "x"))}]
|
|
(t/is (sm/valid? schema params))))
|
|
|
|
(t/testing "rejects error-report exceeding 1MiB"
|
|
(let [params {:subject "Test subject"
|
|
:content "Test content"
|
|
:error-report (apply str (repeat 1048577 "x"))}]
|
|
(t/is (not (sm/valid? schema params)))))))
|