From 4a1b677243533feccf870c93fe70ee63d63b713e Mon Sep 17 00:00:00 2001
From: Peter Cai <peter@typeblog.net>
Date: Wed, 19 Feb 2020 16:49:41 +0800
Subject: [PATCH] index: limit file name length

---
 src/index.coffee | 2 ++
 src/util.coffee  | 5 ++++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/index.coffee b/src/index.coffee
index 2e6b7d0..56f2105 100644
--- a/src/index.coffee
+++ b/src/index.coffee
@@ -49,6 +49,8 @@ handleRequest = (event) ->
 handlePUT = (req, file) ->
   if not util.validateLength req
     return buildInvalidResponse "Maximum upload size: " + util.MAX_UPLOAD_SIZE
+  if file.length > util.MAX_FILENAME_LENGTH
+    return buildInvalidResponse "File name too long (max #{util.MAX_FILENAME_LENGTH})"
   
   # Generate a valid ID first
   id = null
diff --git a/src/util.coffee b/src/util.coffee
index 9d97d52..d18e620 100644
--- a/src/util.coffee
+++ b/src/util.coffee
@@ -2,6 +2,8 @@ import { detect as detectBrowser } from 'detect-browser'
 
 # Maimum upload size (in bytes)
 MAX_UPLOAD_SIZE = 10 * 1024 * 1024 # 10 MB
+# Maximum file name length
+MAX_FILENAME_LENGTH = 255 # bytes
 
 # Validate content-length header
 validateLength = (req) ->
@@ -88,5 +90,6 @@ export {
   isBrowser,
   isText,
   progressText,
-  humanFileSize
+  humanFileSize,
+  MAX_FILENAME_LENGTH
 }
\ No newline at end of file