From 38d65d33f231d541c670ef8e217b6e64e2a56b81 Mon Sep 17 00:00:00 2001
From: Sadeep Madurange <sadeep@asciimx.com>
Date: Fri, 21 Aug 2026 08:39:44 +0800
Subject: Cap message length in CGI.

---
 lex.cgi | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/lex.cgi b/lex.cgi
index 255ab34..a87131a 100755
--- a/lex.cgi
+++ b/lex.cgi
@@ -253,11 +253,18 @@ $plain_text =~ s/\r\n/\n/g;
 $plain_text =~ s/\n-- \n.*$//s;
 $plain_text =~ s/^\s+|\s+$//g;
 
-unless (length($plain_text) > 0) {
+my $plain_text_len = length($plain_text);
+
+unless ($plain_text_len > 0) {
 	log_msg("WARN: Message is empty after stripping");
 	respond_ok();
 }
 
+unless ($plain_text_len <= 200) {
+	log_msg("WARN: Message exceeds 200 characters");
+	respond_ok();
+}
+
 my ($sec, $usec) = gettimeofday();
 my $spool_filename = sprintf("spool_%d%06d_%d.job", $sec, $usec, $$);
 my $tmp_spool_file = "$spool_dir/tmp/$spool_filename.tmp";
-- 
cgit v1.2.3