diff --git a/app/modules/search-params/search-params.ts b/app/modules/search-params/search-params.ts index 2337dd49e..c95474b1c 100644 --- a/app/modules/search-params/search-params.ts +++ b/app/modules/search-params/search-params.ts @@ -6,7 +6,7 @@ import { compressToBase64, decompressFromBase64 } from "~/utils/compression"; const COMPRESSED_PREFIX = "lz~"; const ESCAPED_PREFIX = "lz~~"; const DECODE_CACHE_MAX_SIZE = 300; -const MAX_DECOMPRESSED_VALUE_BYTES = 64 * 1024; +const MAX_DECOMPRESSED_VALUE_BYTES = 256 * 1024; const DECODE_FAILED = Symbol("DECODE_FAILED"); diff --git a/docs/dev/search-params.md b/docs/dev/search-params.md index 5fec52ebe..aacb2b6b4 100644 --- a/docs/dev/search-params.md +++ b/docs/dev/search-params.md @@ -61,7 +61,7 @@ Note: schemas built with `z.preprocess` (like `weaponSplId`, `stageId` in `app/u Any param can arrive compressed (an `lz~` prefix followed by a deflate + base64url payload) without declaring anything — decode transparently decompresses first. Encoding stays human-readable except for `compress: true` params and on-demand compact links via `definition.href(path, values, { compress: true })` (QR codes, share links). A value is only compressed when that actually shortens it, compared as percent-encoded since that is what ends up in the URL. -Since decoding happens before the value schema ever runs, a compressed arrival that inflates past 64 KiB is rejected mid-inflate and resolves to the default, so a hand-crafted URL cannot inflate to an arbitrarily large string on the server. +Since decoding happens before the value schema ever runs, a compressed arrival that inflates past 256 KiB is rejected mid-inflate and resolves to the default, so a hand-crafted URL cannot inflate to an arbitrarily large string on the server. The limit is an order of magnitude above the largest state the app produces (a tier list holding the entire item pool serializes to ~15 KB) while capping how far a URL that fits in the request line can expand. When the href is already built and the definition behind it is not known (e.g. the QR code of `ImageExportDialog`, which compacts whatever path it is given), `SearchParams.compactHref(href)` re-encodes every param of an existing href the same way.