fix: Add missing zod schema check for incoming document.text (#13143)

* fix: Add missing zod schema check for incoming document.text

* feedback

* test

server/models/Document.ts

@@ -356,6 +356,10 @@ class Document extends ArchivableModel<
    * @deprecated Use `content` instead, or `DocumentHelper.toMarkdown` if exporting lossy markdown.
    * This column will be removed in a future migration.
    */
+  @SimpleLength({
+    max: DocumentValidation.maxLength,
+    msg: `Document text content must be ${DocumentValidation.maxLength} characters or less`,
+  })
   @Column(DataType.TEXT)
   @SkipChangeset
   text: string;

server/routes/api/documents/documents.test.ts

@@ -10,6 +10,7 @@ import {
   UserRole,
 } from "@shared/types";
 import { TextHelper } from "@shared/utils/TextHelper";
+import { DocumentValidation } from "@shared/validations";
 import { createContext } from "@server/context";
 import { parser } from "@server/editor";
 import type { Group, User } from "@server/models";
@@ -3456,6 +3457,17 @@ describe("#documents.create", () => {
     expect(body.data.title).toEqual("");
   });
 
+  it("should not create a document with text over the maximum length", async () => {
+    const user = await buildUser();
+    const res = await server.post("/api/documents.create", user, {
+      body: {
+        title: "title",
+        text: "a".repeat(DocumentValidation.maxLength + 1),
+      },
+    });
+    expect(res.status).toEqual(400);
+  });
+
   it("should use template title when doc is created using a template and title is not explicitly passed", async () => {
     const user = await buildUser();
     const template = await buildTemplate({
@@ -3794,6 +3806,21 @@ describe("#documents.update", () => {
     expect(events.length).toEqual(1);
   });
 
+  it("should not update a document with text over the maximum length", async () => {
+    const user = await buildUser();
+    const document = await buildDocument({
+      userId: user.id,
+      teamId: user.teamId,
+    });
+    const res = await server.post("/api/documents.update", user, {
+      body: {
+        id: document.id,
+        text: "a".repeat(DocumentValidation.maxLength + 1),
+      },
+    });
+    expect(res.status).toEqual(400);
+  });
+
   it("should not allow publishing a draft without specifying the collection", async () => {
     const team = await buildTeam();
     const user = await buildUser({ teamId: team.id });

server/routes/api/documents/schema.ts

@@ -8,6 +8,7 @@ import {
   TextEditMode,
   SortFilter,
 } from "@shared/types";
+import { DocumentValidation } from "@shared/validations";
 import { BaseSchema } from "@server/routes/api/schema";
 import { zodIconType, zodIdType, zodShareIdType } from "@server/utils/zod";
 import { ValidateColor } from "@server/validation";
@@ -264,7 +265,7 @@ export const DocumentsUpdateSchema = BaseSchema.extend({
     title: z.string().optional(),
 
     /** Doc text to be updated */
-    text: z.string().optional(),
+    text: z.string().max(DocumentValidation.maxLength).optional(),
 
     /** Icon displayed alongside doc title */
     icon: zodIconType().nullish(),
@@ -428,7 +429,7 @@ export const DocumentsCreateSchema = BaseSchema.extend({
     title: z.string().optional(),
 
     /** Document text */
-    text: z.string().optional(),
+    text: z.string().max(DocumentValidation.maxLength).optional(),
 
     /** Icon displayed alongside doc title */
     icon: zodIconType().optional(),

shared/validations.ts

@@ -64,6 +64,9 @@ export const DocumentValidation = {
 
   /** The maximum recommended size of the document content */
   maxRecommendedLength: 250000,
+
+  /** The maximum length of the document text content */
+  maxLength: 1500 * 1024,
 };
 
 export const GroupValidation = {