fix(api): bound claim wire fields end to end

client/src/cmbuyer_client/core/models.py

@@ -8,6 +8,8 @@ from pathlib import Path
 
 from .errors import ValidationError
 from .validation import (
+    MAX_SKU_TEXT_CODE_POINTS,
+    MAX_TITLE_CODE_POINTS,
     canonical_product_url,
     require_exact_fields,
     require_goods_id,
@@ -83,14 +85,18 @@ class PurchaseTask:
     def __post_init__(self) -> None:
         require_uuid4(self.id, "invalid_task_id")
         require_positive_int(self.version, "invalid_task_version")
-        require_string(self.title, "invalid_task_title", maximum=32 * 1024)
-        if not self.title.strip():
+        require_string(self.title, "invalid_task_title", maximum=MAX_TITLE_CODE_POINTS)
+        if not self.title.strip() or self.title.strip() != self.title:
             raise ValidationError("invalid_task_title")
         require_goods_id(self.goods_id)
         if self.product_url != canonical_product_url(self.goods_id):
             raise ValidationError("invalid_product_url")
-        require_string(self.sku_color, "invalid_sku_color", maximum=32 * 1024)
-        require_string(self.sku_size, "invalid_sku_size", maximum=32 * 1024)
+        require_string(self.sku_color, "invalid_sku_color", maximum=MAX_SKU_TEXT_CODE_POINTS)
+        require_string(self.sku_size, "invalid_sku_size", maximum=MAX_SKU_TEXT_CODE_POINTS)
+        if self.sku_color.strip() != self.sku_color:
+            raise ValidationError("invalid_sku_color")
+        if self.sku_size.strip() != self.sku_size:
+            raise ValidationError("invalid_sku_size")
         require_positive_int(self.quantity, "invalid_quantity")
         require_money(self.max_total_price, "invalid_max_total_price")
 

client/src/cmbuyer_client/core/validation.py

@@ -21,6 +21,10 @@ RFC3339_Z_RE = re.compile(
 )
 MONEY_RE = re.compile(r"(?:0|[1-9][0-9]*)\.[0-9]{2}")
 GOODS_ID_RE = re.compile(r"[0-9]+")
+MAX_TITLE_CODE_POINTS = 120
+MAX_SKU_TEXT_CODE_POINTS = 80
+MAX_GOODS_ID_ASCII_CHARACTERS = 32
+MAX_MONEY_ASCII_CHARACTERS = 32
 
 
 def require_string(value: object, reason: str, *, maximum: int = 4096) -> str:
@@ -92,14 +96,14 @@ def require_positive_int(value: object, reason: str = "invalid_integer") -> int:
 
 
 def require_money(value: object, reason: str = "invalid_money") -> str:
-    text = require_string(value, reason, maximum=32 * 1024)
+    text = require_string(value, reason, maximum=MAX_MONEY_ASCII_CHARACTERS)
     if MONEY_RE.fullmatch(text) is None or text == "0.00":
         raise ValidationError(reason)
     return text
 
 
 def require_goods_id(value: object) -> str:
-    text = require_string(value, "invalid_goods_id", maximum=32 * 1024)
+    text = require_string(value, "invalid_goods_id", maximum=MAX_GOODS_ID_ASCII_CHARACTERS)
     if GOODS_ID_RE.fullmatch(text) is None:
         raise ValidationError("invalid_goods_id")
     return text

client/tests/core/test_models.py

@@ -100,15 +100,9 @@ class CoreModelsTests(unittest.TestCase):
                 changed["task"]["max_total_price"] = invalid
                 ClaimedTask.from_wire(changed)
 
-        wide = claim_wire()
-        wide_goods = "1" * 33
-        wide["task"].update(
-            goods_id=wide_goods,
-            product_url="https://mobile.yangkeduo.com/goods.html?goods_id=" + wide_goods,
-            max_total_price="1" * 31 + ".00",
-            quantity=2_147_483_648,
-        )
-        self.assertEqual(ClaimedTask.from_wire(wide).task.quantity, 2_147_483_648)
+        wide_quantity = claim_wire()
+        wide_quantity["task"]["quantity"] = 2_147_483_648
+        self.assertEqual(ClaimedTask.from_wire(wide_quantity).task.quantity, 2_147_483_648)
         for invalid_goods in ("１２３", "1٢3"):
             changed = claim_wire()
             changed["task"]["goods_id"] = invalid_goods
@@ -120,6 +114,47 @@ class CoreModelsTests(unittest.TestCase):
         with self.assertRaises(ValidationError):
             ClaimedTask.from_wire(too_large)
 
+    def test_claim_fields_share_explicit_server_bounds(self) -> None:
+        legal = claim_wire()
+        legal_goods = "1" * 32
+        legal["task"].update(
+            title="😀" * 120,
+            goods_id=legal_goods,
+            product_url="https://mobile.yangkeduo.com/goods.html?goods_id=" + legal_goods,
+            sku_color="色" * 80,
+            sku_size="码" * 80,
+            max_total_price="1" * 29 + ".00",
+        )
+        claimed = ClaimedTask.from_wire(legal)
+        self.assertEqual(len(claimed.task.title), 120)
+        # Python's default ensure_ascii=True expands astral characters to surrogate
+        # escape pairs, so this is a conservative parser-budget proof as well.
+        self.assertLess(len(json.dumps(legal, separators=(",", ":")).encode()), 32 * 1024)
+
+        mutations = (
+            ("title", "😀" * 121),
+            ("title", " title"),
+            ("sku_color", "色" * 81),
+            ("sku_color", "black "),
+            ("sku_size", "码" * 81),
+            ("sku_size", " M"),
+            ("max_total_price", "1" * 30 + ".00"),
+        )
+        for field, invalid in mutations:
+            changed = claim_wire()
+            changed["task"][field] = invalid
+            with self.subTest(field=field, length=len(invalid)), self.assertRaises(ValidationError):
+                ClaimedTask.from_wire(changed)
+
+        overlong_goods = "1" * 33
+        changed = claim_wire()
+        changed["task"].update(
+            goods_id=overlong_goods,
+            product_url="https://mobile.yangkeduo.com/goods.html?goods_id=" + overlong_goods,
+        )
+        with self.assertRaises(ValidationError):
+            ClaimedTask.from_wire(changed)
+
     def test_wire_strings_reject_lone_surrogates_but_accept_valid_pair(self) -> None:
         for escaped in (r'"\ud800"', r'"\udc00"'):
             value = claim_wire()

client/tests/remote/test_task_source.py

@@ -75,6 +75,32 @@ class TaskSourceTests(unittest.TestCase):
             HttpTaskSource(redirect).claim_next(self.credentials, ClaimRequest(SESSION_ID, REQUEST_ID))
         self.assertEqual(len(redirect.calls), 1)
 
+    def test_claim_rejects_service_field_bound_drift_as_ambiguous(self) -> None:
+        mutations = (
+            ("title", "😀" * 121),
+            ("sku_color", "色" * 81),
+            ("sku_size", "码" * 81),
+            ("max_total_price", "1" * 30 + ".00"),
+        )
+        for field, invalid in mutations:
+            value = claim_wire()
+            value["task"][field] = invalid
+            transport = FakeTransport(response(200, value))
+            with self.subTest(field=field), self.assertRaises(AmbiguousRemoteError):
+                HttpTaskSource(transport).claim_next(self.credentials, ClaimRequest(SESSION_ID, REQUEST_ID))
+            self.assertEqual(len(transport.calls), 1)
+
+        goods_id = "1" * 33
+        value = claim_wire()
+        value["task"].update(
+            goods_id=goods_id,
+            product_url="https://mobile.yangkeduo.com/goods.html?goods_id=" + goods_id,
+        )
+        with self.assertRaises(AmbiguousRemoteError):
+            HttpTaskSource(FakeTransport(response(200, value))).claim_next(
+                self.credentials, ClaimRequest(SESSION_ID, REQUEST_ID)
+            )
+
     def test_fixed_conflict_and_renew_cas(self) -> None:
         conflict = FakeTransport(response(409, {"error": "claim_requires_manual"}))
         with self.assertRaises(ManualRemoteError):