limit status to 500 chars

backend/src/errors/index.ts

@@ -7,7 +7,7 @@ type ErrorResponse = {
 
 const headers = {
 	...cors(),
-	'content-type': 'application/json',
+	'content-type': 'application/json; charset=utf-8',
 } as const
 
 function generateErrorResponse(error: string, status: number, errorDescription?: string): Response {
@@ -57,3 +57,7 @@ export function exceededLimit(detail: string): Response {
 export function resourceNotFound(name: string, id: string): Response {
 	return generateErrorResponse('Resource not found', 404, `${name} "${id}" not found`)
 }
+
+export function validationError(detail: string): Response {
+	return generateErrorResponse('Validation failed', 422, detail)
+}

backend/test/mastodon/statuses.spec.ts

@@ -1010,5 +1010,25 @@ describe('Mastodon APIs', () => {
 			assert.equal(results![0].object_id, note.id.toString())
 			assert.equal(results![1].object_id, note.id.toString())
 		})
+
+		test('reject statuses exceeding limits', async () => {
+			const db = await makeDB()
+			const queue = makeQueue()
+			const actor = await createPerson(domain, db, userKEK, 'sven@cloudflare.com')
+
+			const body = {
+				status: 'a'.repeat(501),
+				visibility: 'public',
+			}
+			const req = new Request('https://example.com', {
+				method: 'POST',
+				headers: { 'content-type': 'application/json' },
+				body: JSON.stringify(body),
+			})
+
+			const res = await statuses.handleRequest(req, db, actor, userKEK, queue, cache)
+			assert.equal(res.status, 422)
+			assertJSON(res)
+		})
 	})
 })

functions/api/v1/statuses.ts

@@ -74,6 +74,10 @@ export async function handleRequest(
 		return new Response('', { status: 400 })
 	}
 
+	if (body.status.length > 500) {
+		return errors.validationError('text character limit of 500 exceeded')
+	}
+
 	const mediaAttachments: Array<Document> = []
 	if (body.media_ids && body.media_ids.length > 0) {
 		if (body.media_ids.length > 4) {