Merge pull request #2181 from omnivore-app/fix/signup-max-lens

Enforce max lengths on sign up data

packages/api/src/routers/auth/auth_router.ts

@@ -74,13 +74,17 @@ const cookieParams = {
 export const isValidSignupRequest = (obj: any): obj is SignupRequest => {
   return (
     'email' in obj &&
-    obj.email.trim().length > 0 && // email must not be empty
+    obj.email.trim().length > 0 &&
+    obj.email.trim().length < 512 && // email must not be empty
     'password' in obj &&
-    obj.password.length >= 8 && // password must be at least 8 characters
+    obj.password.length >= 8 &&
+    obj.password.trim().length < 512 && // password must be at least 8 characters
     'name' in obj &&
-    obj.name.trim().length > 0 && // name must not be empty
+    obj.name.trim().length > 0 &&
+    obj.name.trim().length < 512 && // name must not be empty
     'username' in obj &&
-    obj.username.trim().length > 0 // username must not be empty
+    obj.username.trim().length > 0 &&
+    obj.username.trim().length < 512 // username must not be empty
   )
 }
 

packages/api/test/routers/auth.test.ts

@@ -152,6 +152,23 @@ describe('auth router', () => {
         )
       })
     })
+
+    context('when password is over max length', () => {
+      before(() => {
+        email = 'Some_email'
+        password = 'badpass'.repeat(100)
+        username = 'omnivore_admin'
+      })
+
+      it('redirects to sign up page with error code INVALID_CREDENTIALS', async () => {
+        const res = await signupRequest(email, password, name, username).expect(
+          302
+        )
+        expect(res.header.location).to.endWith(
+          '/email-signup?errorCodes=INVALID_CREDENTIALS'
+        )
+      })
+    })
   })
 
   describe('login', () => {