From: Ardis Lu <ardisglu@gmail.com>
Date: Wed, 17 May 2023 03:28:58 +0000 (-0700)
Subject: Validate short URL length server-side
X-Git-Url: https://git.ardis.lu/?a=commitdiff_plain;h=96261369934379737a965030a75cd4ec47a39255;p=alu.bz

Validate short URL length server-side
---

diff --git a/functions/api.js b/functions/api.js
index 47efb8f..ee0bd03 100644
--- a/functions/api.js
+++ b/functions/api.js
@@ -68,6 +68,9 @@ export async function onRequestPost({ request, env }) {
   }
 
   if (!isRandomlyGenerated) {
+    if (shortUrl.length > 80) {
+      return new Response('The short URL is too long (maximum length is 80 characters).', { status: 400, headers: { 'Content-Type': 'text/plain; charset=UTF-8' } });
+    }
     const message = `Sign this message to confirm you want to create https://alu.bz/${shortUrl} to redirect to ${fullUrl}.`; // Must match frontend exactly
     const signingAddress = verifyMessage(message, signature);
     const nftCount = await getNftCount(signingAddress);