+1

server/go.mod

reviewed

··· 68 68 github.com/prometheus/common v0.45.0 // indirect 69 69 github.com/prometheus/procfs v0.12.0 // indirect 70 70 github.com/rachel-mp4/lrcproto v0.0.0-20250527205756-58da8216f98c // indirect 71 71 + github.com/rivo/uniseg v0.4.7 // indirect 71 72 github.com/segmentio/asm v1.2.0 // indirect 72 73 github.com/spaolacci/murmur3 v1.1.0 // indirect 73 74 github.com/whyrusleeping/cbor-gen v0.2.1-0.20241030202151-b7a6831be65e // indirect

+2

server/go.sum

reviewed

··· 163 163 github.com/rachel-mp4/lrcd v0.0.0-20250603192958-089ba44e79a5/go.mod h1:Hn8xgJ2JwdiFJM5WjamVv4lRTwB6CdcqPjrCvJM7234= 164 164 github.com/rachel-mp4/lrcproto v0.0.0-20250527205756-58da8216f98c h1:nOWeKeE7wph0IcwUyUBi0YBynUnAo4JW/J5DM88x4KM= 165 165 github.com/rachel-mp4/lrcproto v0.0.0-20250527205756-58da8216f98c/go.mod h1:hQzO36tQELGbkmRnUtKeM6NMU34t79ZcTlhM+MO7pHw= 166 166 + github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= 167 167 + github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= 166 168 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4= 167 169 github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII= 168 170 github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=

+32

server/internal/handler/xcvrHandlers.go

reviewed

··· 3 3 import ( 4 4 "encoding/json" 5 5 "errors" 6 6 + "github.com/rivo/uniseg" 6 7 "net/http" 8 8 + "unicode/utf16" 7 9 "xcvr-backend/internal/db" 8 10 "xcvr-backend/internal/types" 9 11 ) ··· 24 26 var pu db.ProfileUpdate 25 27 pu.DID = did 26 28 if p.DisplayName != nil { 29 29 + if uniseg.GraphemeClusterCount(*p.DisplayName) > 64 { 30 30 + h.badRequest(w, errors.New("too many graphemes")) 31 31 + return 32 32 + } 33 33 + runes := []rune(*p.DisplayName) 34 34 + us := utf16.Encode(runes) 35 35 + if len(us) > 640 { 36 36 + h.badRequest(w, errors.New("too many utf16 code points")) 37 37 + return 38 38 + } 27 39 pu.Name = p.DisplayName 28 40 pu.UpdateName = true 29 41 } 30 42 if p.DefaultNick != nil { 43 43 + runes := []rune(*p.DefaultNick) 44 44 + us := utf16.Encode(runes) 45 45 + if len(us) > 16 { 46 46 + h.badRequest(w, errors.New("too many utf16 code points")) 47 47 + return 48 48 + } 31 49 pu.Nick = p.DefaultNick 32 50 pu.UpdateNick = true 33 51 } 34 52 if p.Status != nil { 53 53 + if uniseg.GraphemeClusterCount(*p.DisplayName) > 640 { 54 54 + h.badRequest(w, errors.New("too many graphemes")) 55 55 + return 56 56 + } 57 57 + runes := []rune(*p.DisplayName) 58 58 + us := utf16.Encode(runes) 59 59 + if len(us) > 6400 { 60 60 + h.badRequest(w, errors.New("too many utf16 code points")) 61 61 + return 62 62 + } 35 63 pu.Status = p.Status 36 64 pu.UpdateStatus = true 37 65 } 38 66 if p.Avatar != nil { 67 67 + // TODO think about how to do avatars! 39 68 pu.Avatar = p.Avatar 40 69 pu.UpdateAvatar = true 41 70 } 42 71 if p.Color != nil { 72 72 + if *p.Color > 16777215 || *p.Color < 0 { 73 73 + h.badRequest(w, errors.New("color out of bounds")) 74 74 + } 43 75 pu.Color = p.Color 44 76 pu.UpdateColor = true 45 77 }