mirror of
https://github.com/aljazceru/CTFd.git
synced 2025-12-18 14:34:21 +01:00
7f115bf458
* Add length checking to some sensitive fields in Pages and Challenges. * Works on #1786 This is enough to fix most of the issues but this is really a systemic problem for most of the API endpoints. We should have something that verifies data consistency. Marshmallow is not good enough at this. Pydantic seems like it would be superior here.
38 lines
1.1 KiB
Python
38 lines
1.1 KiB
Python
from marshmallow import ValidationError, pre_load
|
|
|
|
from CTFd.models import Challenges, ma
|
|
|
|
|
|
class ChallengeSchema(ma.ModelSchema):
|
|
class Meta:
|
|
model = Challenges
|
|
include_fk = True
|
|
dump_only = ("id",)
|
|
|
|
@pre_load
|
|
def validate_name(self, data):
|
|
name = data.get("name", "")
|
|
if len(name) > 80:
|
|
raise ValidationError(
|
|
"Challenge could not be saved. Challenge name too long",
|
|
field_names=["name"],
|
|
)
|
|
|
|
@pre_load
|
|
def validate_category(self, data):
|
|
category = data.get("category", "")
|
|
if len(category) > 80:
|
|
raise ValidationError(
|
|
"Challenge could not be saved. Challenge category too long",
|
|
field_names=["category"],
|
|
)
|
|
|
|
@pre_load
|
|
def validate_description(self, data):
|
|
description = data.get("description", "")
|
|
if len(description) >= 65536:
|
|
raise ValidationError(
|
|
"Challenge could not be saved. Challenge description is too long.",
|
|
field_names=["description"],
|
|
)
|