feat(kb): validate slug/tags and cap text fields on article form #224

Merged

nrupard merged 3 commits from feat/mapps-218-kb-article-form-validation into main

2026-06-16 16:54:48 +02:00

David commented

2026-06-16 16:28:28 +02:00

Owner

The New KB Article form stored a user-supplied slug verbatim (spaces, <>, punctuation), accepted unbounded tags including markup like <script>, and set no maxlength on the text fields. This normalizes the slug, sanitizes tags, and caps field lengths so invalid data never reaches the API (MAPPS-218).

Slug: at submit the author-entered value (or the title-derived fallback) now always passes through slugify, which is idempotent on an already-valid slug, so the stored value is always lowercase, hyphen-separated, and free of spaces/<>/punctuation.

Tags: a new sanitize_tags helper strips markup (</>) and control characters, trims, caps each tag at TAG_MAX (50) characters, and drops empties, replacing the previous trim-and-split that stored garbage tags verbatim.

maxlength: Title, Slug, and Summary inputs and the Body textarea now carry client maxlength caps mirroring the server's KB article column limits, so over-long input is blocked at the field rather than failing as an opaque 422.

Adds unit tests for the slug normalization and tag sanitization paths.

#MAPPS-218

Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com

The New KB Article form stored a user-supplied slug verbatim (spaces, `<>`, punctuation), accepted unbounded tags including markup like `<script>`, and set no `maxlength` on the text fields. This normalizes the slug, sanitizes tags, and caps field lengths so invalid data never reaches the API (MAPPS-218). Slug: at submit the author-entered value (or the title-derived fallback) now always passes through `slugify`, which is idempotent on an already-valid slug, so the stored value is always lowercase, hyphen-separated, and free of spaces/`<>`/punctuation. Tags: a new `sanitize_tags` helper strips markup (`<`/`>`) and control characters, trims, caps each tag at `TAG_MAX` (50) characters, and drops empties, replacing the previous trim-and-split that stored garbage tags verbatim. maxlength: Title, Slug, and Summary inputs and the Body textarea now carry client `maxlength` caps mirroring the server's KB article column limits, so over-long input is blocked at the field rather than failing as an opaque 422. Adds unit tests for the slug normalization and tag sanitization paths. #MAPPS-218 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

David added 1 commit

2026-06-16 16:28:28 +02:00

feat(kb): validate slug/tags and cap text fields on article form

Check / clippy + fmt + tests (pull_request) Successful in 1m3s

Details

51a9f181b3

The New KB Article form stored a user-supplied slug verbatim (spaces, `<>`, punctuation), accepted unbounded tags including markup like `<script>`, and set no `maxlength` on the text fields. This normalizes the slug, sanitizes tags, and caps field lengths so invalid data never reaches the API (MAPPS-218).

Slug: at submit the author-entered value (or the title-derived fallback) now always passes through `slugify`, which is idempotent on an already-valid slug, so the stored value is always lowercase, hyphen-separated, and free of spaces/`<>`/punctuation.

Tags: a new `sanitize_tags` helper strips markup (`<`/`>`) and control characters, trims, caps each tag at `TAG_MAX` (50) characters, and drops empties, replacing the previous trim-and-split that stored garbage tags verbatim.

maxlength: Title, Slug, and Summary inputs and the Body textarea now carry client `maxlength` caps mirroring the server's KB article column limits, so over-long input is blocked at the field rather than failing as an opaque 422.

Adds unit tests for the slug normalization and tag sanitization paths.

#MAPPS-218

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

nrupard added 2 commits

2026-06-16 16:53:41 +02:00

Merge remote-tracking branch 'origin/main' into feat/mapps-218-kb-article-form-validation e356c0587b

fix(kb): pass Body maxlength as i64 after the Textarea unify

Check / clippy + fmt + tests (pull_request) Successful in 59s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

3af4ba48f0

This branch predated MAPPS-219, which unified `Textarea::maxlength` to `Option<i64>`. The Body (Markdown) field still passed `BODY_MAX.to_string()`, which no longer matches the prop type after merging main. Pass the cap as `i64` like every other maxlength call site.

#MAPPS-218