Added max length > 255 chars check for custom origin path

magnetikonline · Apr 20, 2024 · 6dc348e · 6dc348e
1 parent 4748e6a
commit 6dc348e
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 0 deletions.
diff --git a/lib.js b/lib.js
@@ -514,6 +514,10 @@ function payloadVerifyRequestOrigin(payload) {
 			throw new Error(`payload property [origin.custom.path] must be empty or begin, but not end with forward slash - got [${custom.path}]`);
 		}
 
+		if (custom.path.length > 255) {
+			throw new Error(`payload property [origin.custom.path] length must not exceed 255 characters - got [${custom.path}]`);
+		}
+
 		// ensure `origin.custom.port` is within bounds
 		if (
 			(custom.port !== 80) &&

diff --git a/test/main-payloadverify.test.js b/test/main-payloadverify.test.js
@@ -592,6 +592,12 @@ function testPayloadVerifyRequestOrigin(inst) {
 		}));
 	});
 
+	assert.throws(function() {
+		callVerify(makePayloadWithOriginCustom(function(payload) {
+			payload.origin.custom.path = '/path/too/long'.repeat(20);
+		}));
+	});
+
 	assert.throws(function() {
 		callVerify(makePayloadWithOriginCustom(function(payload) {
 			delete payload.origin.custom.port;