dunglas / mercure / 40942575726

90%

master: 93%

push

github

fix: don't quote over-long topics in validation errors (#1463)

Invalid topics were quoted in full in the error returned by
Update.Validate() and in the 400 response of the publish endpoint.
%q escapes control bytes to up to four bytes each, so the error grew
with the input, well past the 4096-byte topic limit. Embedders that
copy the error elsewhere, such as into a PHP exception, could allocate
several times the size of a client-controlled value.

Quote the topic only when its length is within the limit.

Discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-N5YWIQC9.

6 of 6 new or added lines in 1 file covered. (100.0%)

2758 of 3058 relevant lines covered (90.19%)

2671.1 hits per line