mirror of
https://github.com/discourse/discourse.git
synced 2026-08-11 02:59:07 +08:00
f4a9c63667Chat::CreateMessage and Chat::UpdateMessage cooked the full, attacker-controlled message (markdown-it rendering in V8) before the chat_maximum_message_length limit was enforced at save!. A single low-privilege request with an oversized body could burn tens of seconds of worker CPU on rendering that was immediately discarded as too long, enabling denial of service against the shared worker pool. Validate the message length in the service contract, which runs before the message is cooked, so oversized input is rejected without the expensive rendering. The model-level length validation remains as defense in depth. The guard covers the create, edit, and Slack-compatible incoming-webhook paths, which all route through these services. |
||
|---|---|---|
| .. | ||
| admin/assets/javascripts | ||
| app | ||
| assets | ||
| config | ||
| db | ||
| lib | ||
| public/images | ||
| spec | ||
| test/javascripts | ||
| about.json | ||
| package.json | ||
| plugin.rb | ||
| README.md | ||
| tsconfig.json | ||
This plugin is still in active development and may change frequently
Documentation
The Discourse Chat plugin adds chat functionality to your Discourse so it can natively support both long-form and short-form communication needs of your online community.
For user documentation, see Discourse Chat.
For developer documentation, see Discourse Documentation.
