marcel/familienarchiv
1
0
Fork 0
Code Issues 107 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(transcription): cap @mention search input at maxlength=100

Browse Source 
Soft-cap on the client side mitigates CWE-400 query amplification
(server-side cap remains a separate backend PR).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Marcel
2026-05-19 22:16:28 +02:00
committed by marcel
parent b6bdebc449
commit d0f4642bb9
2 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
frontend/src/lib/shared/discussion/MentionDropdown.svelte
View File

@@ -166,6 +166,7 @@ function selectItem(item: Person) {
id="mention-search" id="mention-search"
type="search" type="search"
data-test-search-input data-test-search-input
maxlength="100"
class="min-h-[44px] w-full bg-transparent font-sans text-sm text-ink placeholder:text-ink-3 focus:outline-none focus-visible:ring-2 focus-visible:ring-brand-navy focus-visible:ring-inset" class="min-h-[44px] w-full bg-transparent font-sans text-sm text-ink placeholder:text-ink-3 focus:outline-none focus-visible:ring-2 focus-visible:ring-brand-navy focus-visible:ring-inset"
placeholder={m.person_mention_search_prompt()} placeholder={m.person_mention_search_prompt()}
bind:value={searchQuery} bind:value={searchQuery}

8
frontend/src/lib/shared/discussion/MentionDropdown.svelte.test.ts
View File

@@ -154,6 +154,14 @@ describe('MentionDropdown — search input', () => {
expect(input.className).toContain('min-h-[44px]'); expect(input.className).toContain('min-h-[44px]');
}); });
it('caps the search input at maxlength=100 (CWE-400 amplification — Nora on PR #629)', async () => {
render(MentionDropdown, { props: { model: baseModel() } });
const input = document.querySelector('[data-test-search-input]') as HTMLInputElement;
expect(input).not.toBeNull();
expect(input.maxLength).toBe(100);
});
it('invokes onSearch with the current value whenever the user types', async () => { it('invokes onSearch with the current value whenever the user types', async () => {
const onSearch = vi.fn(); const onSearch = vi.fn();
render(MentionDropdown, { props: { model: baseModel(), onSearch } }); render(MentionDropdown, { props: { model: baseModel(), onSearch } });