Audits tgui_input_text() for length issues (#86741)

Fixes #86784

## About The Pull Request

Although some of the issues found were a direct result from #86692
(c698196766), there was still 40% of
length-related issues that wouldn't be covered anyways that are fixed in
this PR. I.E.:

* Name inputs without `MAX_NAME_LEN`
* Desc inputs without `MAX_DESC_LEN`
* Plaque inputs without `MAX_PLAQUE_LEN`
* Some people just screwed up the arguments so it would prefill
something like "40" in the `default` var because they didn't name their
vars.

To help me audit I added a lot of `max_length` named arguments to help
people understand it better. I think it might be kinder to have a
wrapper that handles adding `MAX_MESSAGE_LEN` in a lot of these cases
but I think there is some reason for a coder to be cognitive about input
texts? Let me know what you think. I didn't update anything
admin-related from what I can recall, let me know if anything needs to
be unlimited again.
## Why It's Good For The Game

The change to `INFINITY` notwithstanding, there were still an abundance
of issues that we needed to check up on. A lot of these are filtered on
down the line but it is clear that there needs to be something to catch
these issues. Maybe we could lint to make `max_length` a mandatory
argument? I don't know if that's necessary at all but I think that the
limit should be set by the invoker due to the wide arrangement of cases
that this proc could be used in.

This could all be a big nothingburger if the aforementioned PR is
reverted but a big chunk of cases fixed in this PR need to be fixed
regardless of that since people could put in 1024 character names for
stuff like guardians (or more now with the change). Consider this
"revert agnostic".
## Changelog
🆑
fix: A lot of instances where you could fill in 1024-character names
(normal limit is 42) have been patched out, along with too-long plaque
names, too-long descriptions, and more.
/🆑
This commit is contained in:
san7890
2024-09-20 22:46:41 +00:00
committed by GitHub
parent 840e73b1a3
commit a4328ae1f9
86 changed files with 183 additions and 137 deletions
+1 -1
View File
@@ -320,7 +320,7 @@ ADMIN_VERB(give_mob_action, R_FUN, "Give Mob Action", ADMIN_VERB_NO_DESCRIPTION,
if(isnull(ability_melee_cooldown) || ability_melee_cooldown < 0)
ability_melee_cooldown = 2
add_ability.melee_cooldown_time = ability_melee_cooldown * 1 SECONDS
add_ability.name = tgui_input_text(user, "Choose ability name", "Ability name", "Generic Ability")
add_ability.name = tgui_input_text(user, "Choose ability name", "Ability name", "Generic Ability", max_length = MAX_NAME_LEN)
add_ability.create_sequence_actions()
else
add_ability = new ability_type(ability_recipient)
+1 -1
View File
@@ -100,7 +100,7 @@
drip.vars[slot] = null
if("rename")
var/newname = tgui_input_text(owner, "What do you want to name this outfit?", OUTFIT_EDITOR_NAME)
var/newname = tgui_input_text(owner, "What do you want to name this outfit?", OUTFIT_EDITOR_NAME, max_length = MAX_NAME_LEN)
if(newname)
drip.name = newname
if("save")
+3 -3
View File
@@ -55,7 +55,7 @@ ADMIN_VERB(painting_manager, R_ADMIN, "Paintings Manager", "View and redact pain
if("rename")
//Modify the metadata
var/old_title = chosen_painting.title
var/new_title = tgui_input_text(user, "New painting title?", "Painting Rename", chosen_painting.title)
var/new_title = tgui_input_text(user, "New painting title?", "Painting Rename", chosen_painting.title, max_length = MAX_NAME_LEN)
if(!new_title)
return
chosen_painting.title = new_title
@@ -63,7 +63,7 @@ ADMIN_VERB(painting_manager, R_ADMIN, "Paintings Manager", "View and redact pain
return TRUE
if("rename_author")
var/old_name = chosen_painting.creator_name
var/new_name = tgui_input_text(user, "New painting author name?", "Painting Rename", chosen_painting.creator_name)
var/new_name = tgui_input_text(user, "New painting author name?", "Painting Rename", chosen_painting.creator_name, max_length = MAX_NAME_LEN)
if(!new_name)
return
chosen_painting.creator_name = new_name
@@ -83,7 +83,7 @@ ADMIN_VERB(painting_manager, R_ADMIN, "Paintings Manager", "View and redact pain
log_admin("[key_name(user)] has removed tag [params["tag"]] from persistent painting made by [chosen_painting.creator_ckey] with id [chosen_painting.md5].")
return TRUE
if("add_tag")
var/tag_name = tgui_input_text(user, "New tag name?", "Add Tag")
var/tag_name = tgui_input_text(user, "New tag name?", "Add Tag", max_length = MAX_NAME_LEN)
if(!tag_name)
return
if(!chosen_painting.tags)
+1 -1
View File
@@ -81,7 +81,7 @@
return
var/mob/user = usr
if(href_list["edit_label"])
var/new_label = tgui_input_text(user, "Choose a new label", "Sound Emitter")
var/new_label = tgui_input_text(user, "Choose a new label", "Sound Emitter", max_length = MAX_NAME_LEN)
if(!new_label)
return
maptext = MAPTEXT(new_label)
+3 -3
View File
@@ -234,14 +234,14 @@ ADMIN_VERB(access_news_network, R_ADMIN, "Access Newscaster Network", "Allows yo
return TRUE
if("setCriminalName")
var/temp_name = tgui_input_text(usr, "Write the Criminal's Name", "Warrent Alert Handler", "John Doe", MAX_NAME_LEN, multiline = FALSE)
var/temp_name = tgui_input_text(usr, "Write the Criminal's Name", "Warrent Alert Handler", "John Doe", max_length = MAX_NAME_LEN, multiline = FALSE)
if(!temp_name)
return TRUE
criminal_name = temp_name
return TRUE
if("setCrimeData")
var/temp_desc = tgui_input_text(usr, "Write the Criminal's Crimes", "Warrent Alert Handler", "Unknown", MAX_BROADCAST_LEN, multiline = TRUE)
var/temp_desc = tgui_input_text(usr, "Write the Criminal's Crimes", "Warrent Alert Handler", "Unknown", max_length = MAX_BROADCAST_LEN, multiline = TRUE)
if(!temp_desc)
return TRUE
crime_description = temp_desc
@@ -339,7 +339,7 @@ ADMIN_VERB(access_news_network, R_ADMIN, "Access Newscaster Network", "Allows yo
if(channel_name == potential_channel.channel_ID)
current_channel = potential_channel
break
var/temp_message = tgui_input_text(usr, "Write your Feed story", "Network Channel Handler", feed_channel_message, multiline = TRUE)
var/temp_message = tgui_input_text(usr, "Write your Feed story", "Network Channel Handler", feed_channel_message, max_length = MAX_BROADCAST_LEN, multiline = TRUE)
if(length(temp_message) <= 1)
return TRUE
if(temp_message)
+10 -2
View File
@@ -269,13 +269,21 @@ ADMIN_VERB(command_report_footnote, R_ADMIN, "Command Report Footnote", "Adds a
var/datum/command_footnote/command_report_footnote = new /datum/command_footnote()
GLOB.communications_controller.block_command_report += 1 //Add a blocking condition to the counter until the inputs are done.
command_report_footnote.message = tgui_input_text(user, "This message will be attached to the bottom of the roundstart threat report. Be sure to delay the roundstart report if you need extra time.", "P.S.")
command_report_footnote.message = tgui_input_text(
user,
"This message will be attached to the bottom of the roundstart threat report. Be sure to delay the roundstart report if you need extra time.",
"P.S.",
)
if(!command_report_footnote.message)
GLOB.communications_controller.block_command_report -= 1
qdel(command_report_footnote)
return
command_report_footnote.signature = tgui_input_text(user, "Whose signature will appear on this footnote?", "Also sign here, here, aaand here.")
command_report_footnote.signature = tgui_input_text(
user,
"Whose signature will appear on this footnote?",
"Also sign here, here, aaand here.",
)
if(!command_report_footnote.signature)
command_report_footnote.signature = "Classified"
+1 -1
View File
@@ -24,7 +24,7 @@ ADMIN_VERB(law_panel, R_ADMIN, "Law Panel", "View the AI laws.", ADMIN_CATEGORY_
var/lawtype = tgui_input_list(user, "Select law type", "Law type", lawtypes)
if(isnull(lawtype))
return FALSE
var/lawtext = tgui_input_text(user, "Input law text", "Law text")
var/lawtext = tgui_input_text(user, "Input law text", "Law text") // admin verb so no max length and also any user-level input is config based already so ehhhh
if(!lawtext)
return FALSE
if(QDELETED(src) || QDELETED(borgo))