Error accessing the forum after saving custom CSS with more than +68000 characters

[iamdarkle]

Bug Report

Current Behavior
Error when accessing the forum after saving in the admin panel a custom CSS code of +68000 characters (doesn't mean it's exactly that number, in my case I've experienced it when reaching that number of characters).

This causes that when saving the CSS code the last lines are cut, and therefore in my case for example this caused a ParseError: missing closing'}' error in the entire forum because it just cut the code before a }

Steps to Reproduce

1. Go to admin panel ->Appearance -> Edit custom CSS
2. Paste the CSS code
3. Save (no error will appear)
   After this if you reopen the Edit Custom CSS box you will see the cut code
4. Go to the forum and you will see an error (depending on where the CSS code is cut) or lack of changes

Expected Behavior
Avoid cutting the CSS code when it has ±68000 characters through the admin panel.

Environment

• Flarum version: 1.0.4

Possible Solution (by @clarkwinkelmann)

We have a step to validate the Less but the code probably gets truncated when inserted in the database, so the validation won't catch it https://github.com/flarum/core/blob/master/src/Forum/ValidateCustomLess.php

We should probably add max length validation for all settings. This probably has never been an issue in the past because most settings are short strings and there was never any risk of reaching the TEXT limitation.

[davwheat]

In my honest opinion, if you've got 68k chars of Less, that should go in a custom theme extension. Despite that, though, we should still enforce a maxlength on these fields.

[iamdarkle]

Yeah I didn't plan to get to this point... this has been a wake up call, I've been putting off cleaning up the css code for a while 😅

[clarkwinkelmann]

This same issue could also affect multiple of my extension in a slightly different way.

I have multiple extensions that use JSON format for their settings. JSON is mostly used because I don't expect a lot of data to be saved, but for example if you use my Predefined Avatars extension and keep adding more avatars, the JSON could get too big and get truncated. Then you'll loose data because some of it has been cut off and the rest cannot be parsed anymore.

Just adding a typical string max: validation on the value would at least produce an error message before any value gets saved and truncated.

This probably also affects the enabled_extensions settings, though you probably need a TON of extensions before reaching the limit. But I suppose once you're just before the limit, enabling any more extension will brick the forum. That situation needs to be handled on the server-side though.