fixes: add DNS timeout, removed duplicate import, added OS-aware path validation, used centralized validation function for pubkey, made sanitize input length limit configurable, used explicit base directory, added a few type hints.

2026-05-14 19:35:18 +00:00 · 2025-12-09 19:58:42 -08:00
parent 3f8ae492f1
commit d80d808f02
4 changed files with 79 additions and 21 deletions
@@ -273,8 +273,10 @@ class MessageHandler:
                        break
            
            # Sanitize message content to prevent injection attacks
+            # Note: Firmware enforces 150-char limit at hardware level, so we disable length check
+            # but still strip control characters for security
            message_content = payload.get('text', '')
-            message_content = sanitize_input(message_content, max_length=500, strip_controls=True)
+            message_content = sanitize_input(message_content, max_length=None, strip_controls=True)
            
            # Convert to our message format
            message = MeshMessage(