Leahnaya/sendou.ink
1
0
Fork 0
mirror of https://github.com/Sendouc/sendou.ink.git synced 2026-08-04 11:22:40 -05:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Bump limit

Browse Source
This commit is contained in:
Kalle 2026-08-03 17:52:58 +03:00
parent 6922efaed1
commit 1ce7ff5ea0
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
app/modules/search-params/search-params.ts
View File

@ -6,7 +6,7 @@ import { compressToBase64, decompressFromBase64 } from "~/utils/compression";
const COMPRESSED_PREFIX = "lz~";
const ESCAPED_PREFIX = "lz~~";
const DECODE_CACHE_MAX_SIZE = 300;
const MAX_DECOMPRESSED_VALUE_BYTES = 64 * 1024;
const MAX_DECOMPRESSED_VALUE_BYTES = 256 * 1024;
const DECODE_FAILED = Symbol("DECODE_FAILED");

2
docs/dev/search-params.md
View File

@ -61,7 +61,7 @@ Note: schemas built with `z.preprocess` (like `weaponSplId`, `stageId` in `app/u
Any param can arrive compressed (an `lz~` prefix followed by a deflate + base64url payload) without declaring anything — decode transparently decompresses first. Encoding stays human-readable except for `compress: true` params and on-demand compact links via `definition.href(path, values, { compress: true })` (QR codes, share links). A value is only compressed when that actually shortens it, compared as percent-encoded since that is what ends up in the URL.
Since decoding happens before the value schema ever runs, a compressed arrival that inflates past 64 KiB is rejected mid-inflate and resolves to the default, so a hand-crafted URL cannot inflate to an arbitrarily large string on the server.
Since decoding happens before the value schema ever runs, a compressed arrival that inflates past 256 KiB is rejected mid-inflate and resolves to the default, so a hand-crafted URL cannot inflate to an arbitrarily large string on the server. The limit is an order of magnitude above the largest state the app produces (a tier list holding the entire item pool serializes to ~15 KB) while capping how far a URL that fits in the request line can expand.
When the href is already built and the definition behind it is not known (e.g. the QR code of `ImageExportDialog`, which compacts whatever path it is given), `SearchParams.compactHref(href)` re-encodes every param of an existing href the same way.