From 78017a333d622a13c509e7e3bf79290d939530ef Mon Sep 17 00:00:00 2001 From: Chris Sherwood Date: Sun, 30 Aug 2026 21:12:07 -0700 Subject: [PATCH] fix(maps): cap marker notes at 500 characters server-side The UI enforces 500 characters but the validator did not, so the API accepted up to the MySQL TEXT ceiling. The API needs no authentication by design, so an uncapped free-text column reachable from any page a user visits is a cheap way to bloat the database. Matches the limit the form already shows. Found in a security review of the release PRs. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01F8Mgg1vd2eKSs8StZiuyMV --- admin/app/controllers/maps_controller.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/admin/app/controllers/maps_controller.ts b/admin/app/controllers/maps_controller.ts index 2a8514d9..1eb9a1ac 100644 --- a/admin/app/controllers/maps_controller.ts +++ b/admin/app/controllers/maps_controller.ts @@ -190,7 +190,7 @@ export default class MapsController { icon: vine.string().trim().maxLength(50).nullable().optional(), icon_color: vine.string().trim().maxLength(7).nullable().optional(), visible: vine.boolean().optional(), - notes: vine.string().trim().nullable().optional(), + notes: vine.string().trim().maxLength(500).nullable().optional(), marker_type: vine.string().trim().maxLength(20).optional(), }) ) @@ -231,7 +231,7 @@ export default class MapsController { visible: vine.boolean().optional(), longitude: vine.number().min(-180).max(180).optional(), latitude: vine.number().min(-90).max(90).optional(), - notes: vine.string().trim().nullable().optional(), + notes: vine.string().trim().maxLength(500).nullable().optional(), marker_type: vine.string().trim().maxLength(20).optional(), }) )