fix(api): bound claim wire fields end to end

admin/internal/tasks/tasks.go

@@ -9,14 +9,21 @@ import (
 	"strconv"
 	"strings"
 	"time"
+	"unicode/utf8"
 )
 
 const (
-	maxTitleLength = 120
-	maxSKUText     = 80
+	MaxTitleCodePoints      = 120
+	MaxSKUTextCodePoints    = 80
+	MaxGoodsIDCharacters    = 32
+	MaxMoneyASCIICharacters = 32
+	maxSKUText              = MaxSKUTextCodePoints
 )
 
-var ErrCreateKeyConflict = errors.New("create key conflicts with a different task")
+var (
+	ErrCreateKeyConflict = errors.New("create key conflicts with a different task")
+	ErrInvalidDraft      = errors.New("invalid draft")
+)
 
 type Draft struct {
 	ID            string
@@ -41,13 +48,13 @@ func Validate(form Form) (Draft, Errors) {
 	if !validUUID(draft.ID) {
 		errors["create_key"] = "创建请求已过期，请重新打开表单。"
 	}
-	if draft.Title == "" || len([]rune(draft.Title)) > maxTitleLength {
+	if !validBoundedText(draft.Title, MaxTitleCodePoints) {
 		errors["title"] = "任务名称不能为空，且不能超过 120 个字符。"
 	}
-	if draft.SKUColor == "" || len([]rune(draft.SKUColor)) > maxSKUText {
+	if !validBoundedText(draft.SKUColor, MaxSKUTextCodePoints) {
 		errors["sku_color"] = "颜色分类不能为空，且不能超过 80 个字符。"
 	}
-	if draft.SKUSize == "" || len([]rune(draft.SKUSize)) > maxSKUText {
+	if !validBoundedText(draft.SKUSize, MaxSKUTextCodePoints) {
 		errors["sku_size"] = "尺码不能为空，且不能超过 80 个字符。"
 	}
 	goodsID, ok := CanonicalGoodsID(strings.TrimSpace(form.ProductURL))
@@ -93,6 +100,9 @@ func CanonicalGoodsID(value string) (string, bool) {
 			return "", false
 		}
 	}
+	if !ValidGoodsID(goodsIDs[0]) {
+		return "", false
+	}
 	return goodsIDs[0], true
 }
 
@@ -155,5 +165,43 @@ func normalizeMoney(value string) (string, bool) {
 	if whole == "0" && strings.Trim(fraction, "0") == "" {
 		return "", false
 	}
-	return whole + "." + (fraction + "00")[:2], true
+	canonical := whole + "." + (fraction + "00")[:2]
+	if len(canonical) > MaxMoneyASCIICharacters {
+		return "", false
+	}
+	return canonical, true
+}
+
+// ValidTaskWireFields is shared by creation, authorization and claim. Keeping one
+// bounded domain prevents a database row from being valid in one stage but impossible
+// to encode inside the fixed claim response budget in another stage.
+func ValidTaskWireFields(title, goodsID, skuColor, skuSize, maxTotalPrice string) bool {
+	return validBoundedText(title, MaxTitleCodePoints) &&
+		ValidAuthorizationFields(goodsID, skuColor, skuSize, maxTotalPrice)
+}
+
+func ValidAuthorizationFields(goodsID, skuColor, skuSize, totalPriceCap string) bool {
+	return ValidGoodsID(goodsID) &&
+		validBoundedText(skuColor, MaxSKUTextCodePoints) &&
+		validBoundedText(skuSize, MaxSKUTextCodePoints) &&
+		ValidCanonicalMoney(totalPriceCap)
+}
+
+func ValidGoodsID(value string) bool {
+	if value == "" || len(value) > MaxGoodsIDCharacters {
+		return false
+	}
+	for index := 0; index < len(value); index++ {
+		if value[index] < '0' || value[index] > '9' {
+			return false
+		}
+	}
+	return true
+}
+
+func validBoundedText(value string, maximum int) bool {
+	// RuneCountInString replaces malformed byte sequences with RuneError. Validate first
+	// so corrupt SQLite text cannot consume the code-point budget as if it were legitimate.
+	return utf8.ValidString(value) && value != "" && strings.TrimSpace(value) == value &&
+		utf8.RuneCountInString(value) <= maximum
 }