feat: Limit email input on auth pages to 255 chars

Excessively long emails reported make server unresponsive. We could at some point, consider adding a configuration for sysadmins to bypass this setting on their instance if they want. Signed-off-by: fenn-cs <[email protected]>
nextcloud · Mar 16, 2024 · b6a0c6a · b6a0c6a
1 parent eb61f6b
commit b6a0c6a
Show file tree

Hide file tree

Showing 5 changed files with 60 additions and 2 deletions.
diff --git a/core/Controller/LoginController.php b/core/Controller/LoginController.php
@@ -336,9 +336,15 @@ public function tryLogin(Chain $loginChain,
 			);
 		}
 
+		$user = trim($user);
+
+		if (strlen($user) > 255) {
+			return new JSONResponse($this->error($this->l10n->t('Unsupported email length (>255)')));
+		}
+
 		$data = new LoginData(
 			$this->request,
-			trim($user),
+			$user,
 			$password,
 			$redirect_url,
 			$timezone,

diff --git a/core/Controller/LostController.php b/core/Controller/LostController.php
@@ -182,6 +182,10 @@ public function email(string $user): JSONResponse {
 
 		$user = trim($user);
 
+		if (strlen($user) > 255) {
+			return new JSONResponse($this->error($this->l10n->t('Unsupported email length (>255)')));
+		}
+
 		\OCP\Util::emitHook(
 			'\OCA\Files_Sharing\API\Server2Server',
 			'preLoginNameUsedAsUserName',

diff --git a/core/src/components/login/LoginForm.vue b/core/src/components/login/LoginForm.vue
@@ -62,12 +62,15 @@
 				ref="user"
 				:label="loginText"
 				name="user"
+				:maxlength="255"
 				:value.sync="user"
 				:class="{shake: invalidPassword}"
 				autocapitalize="none"
 				:spellchecking="false"
 				:autocomplete="autoCompleteAllowed ? 'username' : 'off'"
 				required
+				:error="userNameInputLengthIs255"
+				:helper-text="userInputHelperText"
 				data-login-form-input-user
 				@change="updateUsername" />
 
@@ -117,6 +120,8 @@ import NcNoteCard from '@nextcloud/vue/dist/Components/NcNoteCard.js'
 
 import LoginButton from './LoginButton.vue'
 
+import AuthMixin from '../../mixins/auth.js'
+
 export default {
 	name: 'LoginForm',
 
@@ -126,6 +131,7 @@ export default {
 		NcTextField,
 		NcNoteCard,
 	},
+	mixins: [AuthMixin],
 
 	props: {
 		username: {
@@ -160,7 +166,7 @@ export default {
 			type: Array,
 			default() {
 				return []
-			}
+			},
 		},
 	},
 

diff --git a/core/src/components/login/ResetPassword.vue b/core/src/components/login/ResetPassword.vue
@@ -25,8 +25,11 @@
 			<NcTextField id="user"
 				:value.sync="user"
 				name="user"
+				:maxlength="255"
 				autocapitalize="off"
 				:label="t('core', 'Login or email')"
+				:error="userNameInputLengthIs255"
+				:helper-text="userInputHelperText"
 				required
 				@change="updateUsername" />
 			<LoginButton :value="t('core', 'Reset password')" />
@@ -60,13 +63,16 @@ import LoginButton from './LoginButton.vue'
 import NcTextField from '@nextcloud/vue/dist/Components/NcTextField.js'
 import NcNoteCard from '@nextcloud/vue/dist/Components/NcNoteCard.js'
 
+import AuthMixin from '../../mixins/auth.js'
+
 export default {
 	name: 'ResetPassword',
 	components: {
 		LoginButton,
 		NcNoteCard,
 		NcTextField,
 	},
+	mixins: [AuthMixin],
 	props: {
 		username: {
 			type: String,

diff --git a/core/src/mixins/auth.js b/core/src/mixins/auth.js
@@ -0,0 +1,36 @@
+/**
+ * @copyright Copyright (c) 2024 Fon E. Noel NFEBE <[email protected]>
+ *
+ * @author Fon E. Noel NFEBE <[email protected]>
+ *
+ * @license AGPL-3.0-or-later
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+export default {
+
+	computed: {
+		userNameInputLengthIs255() {
+			return this.user.length >= 255
+		},
+		userInputHelperText() {
+			if (this.userNameInputLengthIs255) {
+				return t('core', 'Email length is at max (255)')
+			}
+			return undefined
+		},
+	},
+}