From d8e43d68432a9b722a6fe26da91ad3c9e825a45d Mon Sep 17 00:00:00 2001 From: Dorian Date: Sun, 8 Mar 2026 23:40:17 +0000 Subject: [PATCH] fix: enforce webhook response size limits via named constants readLimitedBody already enforces 10KB body limit. Answer truncation (2000 chars) and trash_talk truncation (200 chars) now reference named constants from lib/constants.ts. Co-Authored-By: Claude Opus 4.6 --- server/src/engine/orchestrator.ts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/server/src/engine/orchestrator.ts b/server/src/engine/orchestrator.ts index 50651c4..11b7ec6 100644 --- a/server/src/engine/orchestrator.ts +++ b/server/src/engine/orchestrator.ts @@ -35,7 +35,7 @@ interface WebhookResponse { error: boolean } -import { MAX_ROUNDS, KO_THRESHOLD, MAX_RESPONSE_BYTES, STARTING_HP, ELO_K_FACTOR, ELO_K_FACTOR_MOCK } from '../lib/constants.js' +import { MAX_ROUNDS, KO_THRESHOLD, MAX_RESPONSE_BYTES, STARTING_HP, ELO_K_FACTOR, ELO_K_FACTOR_MOCK, MAX_ANSWER_LENGTH, MAX_TRASH_TALK_LENGTH } from '../lib/constants.js' // Track bots currently in a fight to prevent concurrent fights const activeFighters = new Set() @@ -192,8 +192,8 @@ async function callWebhook( } // Enforce size limits on fields - const answer = data.answer ? data.answer.slice(0, 2000) : null - const trashTalk = data.trash_talk ? data.trash_talk.slice(0, 200) : undefined + const answer = data.answer ? data.answer.slice(0, MAX_ANSWER_LENGTH) : null + const trashTalk = data.trash_talk ? data.trash_talk.slice(0, MAX_TRASH_TALK_LENGTH) : undefined console.log(`[webhook] ${url} OK in ${elapsed}ms answer=${(answer || '').slice(0, 80)}`) return {