From a3987a7c56bd324b4ba33fa5fa33e4709cb26864 Mon Sep 17 00:00:00 2001
From: iamacook <aaron@safe.global>
Date: Mon, 31 Jul 2023 15:50:38 +0100
Subject: [PATCH] fix: limit `origin` length

---
 src/utils/__tests__/transactions.test.ts | 59 +++++++++++++++++++++++-
 src/utils/transactions.ts                | 15 +++++-
 2 files changed, 71 insertions(+), 3 deletions(-)

diff --git a/src/utils/__tests__/transactions.test.ts b/src/utils/__tests__/transactions.test.ts
index b997ce98cb..fcc6529780 100644
--- a/src/utils/__tests__/transactions.test.ts
+++ b/src/utils/__tests__/transactions.test.ts
@@ -1,5 +1,11 @@
-import type { ConflictHeader, DateLabel, Label, Transaction } from '@safe-global/safe-gateway-typescript-sdk'
-import { getQueuedTransactionCount } from '../transactions'
+import type {
+  ConflictHeader,
+  DateLabel,
+  Label,
+  SafeAppData,
+  Transaction,
+} from '@safe-global/safe-gateway-typescript-sdk'
+import { getQueuedTransactionCount, getTxOrigin } from '../transactions'
 
 describe('transactions', () => {
   describe('getQueuedTransactionCount', () => {
@@ -59,4 +65,53 @@ describe('transactions', () => {
       expect(getQueuedTransactionCount(txPage)).toBe('1')
     })
   })
+
+  describe('getTxOrigin', () => {
+    it('should return undefined if no app is provided', () => {
+      expect(getTxOrigin(undefined)).toBe(undefined)
+    })
+
+    it('should return a stringified object with the app name and url', () => {
+      const app = {
+        name: 'Test',
+        url: 'https://test.com',
+      } as SafeAppData
+
+      expect(getTxOrigin(app)).toBe('{"name":"Test","url":"https://test.com"}')
+    })
+
+    it('should limit the URL to 200 characters', () => {
+      const app = {
+        name: 'Test',
+        url: 'https://test.com/' + 'a'.repeat(1337),
+      } as SafeAppData
+
+      expect(JSON.stringify(app).length).toBeGreaterThan(200)
+
+      const result = getTxOrigin(app)
+
+      expect(result?.length).toBe(200)
+
+      expect(result).toBe(
+        '{"name":"Test","url":"https://test.com/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}',
+      )
+    })
+
+    it('should preserve the name when limiting', () => {
+      const app = {
+        name: 'Test' + 'a'.repeat(1337),
+        url: '',
+      } as SafeAppData
+
+      expect(JSON.stringify(app).length).toBeGreaterThan(200)
+
+      const result = getTxOrigin(app)
+
+      expect(result?.length).toBe(200)
+
+      expect(result).toBe(
+        '{"name":"Testaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","url":""}',
+      )
+    })
+  })
 })
diff --git a/src/utils/transactions.ts b/src/utils/transactions.ts
index c6a8dbd856..e736eb145e 100644
--- a/src/utils/transactions.ts
+++ b/src/utils/transactions.ts
@@ -180,6 +180,8 @@ export const getQueuedTransactionCount = (txPage?: TransactionListPage): string
 }
 
 export const getTxOrigin = (app?: SafeAppData): string | undefined => {
+  const MAX_ORIGIN_LENGTH = 200
+
   if (!app) {
     return
   }
@@ -187,7 +189,18 @@ export const getTxOrigin = (app?: SafeAppData): string | undefined => {
   let origin: string | undefined
 
   try {
-    origin = JSON.stringify({ name: app.name, url: app.url })
+    const maxNameLength =
+      MAX_ORIGIN_LENGTH -
+      JSON.stringify({
+        name: '', // Must include empty string to avoid including the length of `undefined`
+        url: '',
+      }).length
+    const maxUrlLength = maxNameLength - app.name.length
+
+    origin = JSON.stringify({
+      name: app.name.slice(0, maxNameLength),
+      url: app.url.slice(0, maxUrlLength),
+    })
   } catch (e) {
     logError(Errors._808, e)
   }