From b8301de6fa1393a83bbeb90f1ca28bcc5a5a8e8f Mon Sep 17 00:00:00 2001 From: tejas Date: Wed, 26 Aug 2026 10:04:34 +0100 Subject: [PATCH] Remove grecaptcha_response max length Google reCAPTCHA tokens now exceed 2048 chars, so every enquiry POST was rejected with a 400 before validation. Google documents no maximum token length; the cap has been outgrown twice before (#556 raised it 1000 -> 2048). Remove it, keep min_length. Co-Authored-By: Claude Fable 5 --- tcsocket/app/validation.py | 2 +- tests/test_enquiries.py | 14 ++++++++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/tcsocket/app/validation.py b/tcsocket/app/validation.py index fe906861..3d487d95 100644 --- a/tcsocket/app/validation.py +++ b/tcsocket/app/validation.py @@ -180,7 +180,7 @@ class EnquiryModal(BaseModel): # subject: Optional[int] = None # qual_level: Optional[int] = None upstream_http_referrer: Optional[str] = None - grecaptcha_response: constr(min_length=20, max_length=2048) + grecaptcha_response: constr(min_length=20) terms_and_conditions: bool = False @validator('upstream_http_referrer') diff --git a/tests/test_enquiries.py b/tests/test_enquiries.py index ee3ff9c7..78af4115 100644 --- a/tests/test_enquiries.py +++ b/tests/test_enquiries.py @@ -96,6 +96,20 @@ async def test_post_enquiry_success(cli, company, other_server, worker): ] == other_server.app['request_log'] +async def test_post_enquiry_long_grecaptcha_response(cli, company, other_server, worker): + other_server.app['extra_attributes'] = 'default' + data = { + 'client_name': 'Cat Flap', + 'grecaptcha_response': 'good' * 1000, + 'terms_and_conditions': True, + } + url = cli.server.app.router['enquiry'].url_for(company=company.public_key) + r = await cli.post(url, data=json.dumps(data), headers={'User-Agent': 'Testing Browser'}) + assert r.status == 201, await r.text() + await worker.run_check() + assert ('grecaptcha_post', {'secret': 'X' * 30, 'response': 'good' * 1000}) in other_server.app['request_log'] + + async def test_post_enquiry_datetime(cli, company, other_server, worker): other_server.app['extra_attributes'] = 'datetime' data = {