Fix username links resulting in truncated chat messages (#11945)

* introduce MAX_MESSAGE_LENGTH constant

* add test

* fix path

* fix and tests

* fix typo in tests

website/server/controllers/api-v3/chat.js

@@ -2,7 +2,10 @@ import nconf from 'nconf';
 import { authWithHeaders } from '../../middlewares/auth';
 import { model as Group } from '../../models/group';
 import { model as User } from '../../models/user';
-import { chatModel as Chat } from '../../models/message';
+import {
+  chatModel as Chat,
+  sanitizeText as sanitizeMessageText,
+} from '../../models/message';
 import common from '../../../common';
 import {
   BadRequest,
@@ -187,7 +190,8 @@ api.postChat = {
       throw new NotAuthorized(res.t('messageGroupChatSpam'));
     }
 
-    const [message, mentions, mentionedMembers] = await highlightMentions(req.body.message);
+    const sanitizedMessageText = sanitizeMessageText(req.body.message);
+    const [message, mentions, mentionedMembers] = await highlightMentions(sanitizedMessageText);
     let client = req.headers['x-client'] || '3rd Party';
     if (client) {
       client = client.replace('habitica-', '');

website/server/controllers/api-v3/members.js

@@ -21,6 +21,9 @@ import {
 import { sendNotification as sendPushNotification } from '../../libs/pushNotifications';
 import common from '../../../common';
 import { sentMessage } from '../../libs/inbox';
+import {
+  sanitizeText as sanitizeMessageText,
+} from '../../models/message';
 import { highlightMentions } from '../../libs/highlightMentions';
 
 const { achievements } = common;
@@ -677,7 +680,8 @@ api.sendPrivateMessage = {
     if (validationErrors) throw validationErrors;
 
     const sender = res.locals.user;
-    const message = (await highlightMentions(req.body.message))[0];
+    const sanitizedMessageText = sanitizeMessageText(req.body.message);
+    const message = (await highlightMentions(sanitizedMessageText))[0];
 
     const receiver = await User.findById(req.body.toUserId).exec();
     if (!receiver) throw new NotFound(res.t('userNotFound'));

website/server/models/message.js

@@ -3,6 +3,7 @@ import { v4 as uuid } from 'uuid';
 import { defaults } from 'lodash';
 import removeMd from 'remove-markdown';
 import baseModel from '../libs/baseModel';
+import shared from '../../common';
 
 const defaultSchema = () => ({
   id: String,
@@ -113,14 +114,20 @@ export function setUserStyles (newMessage, user) {
   }
 }
 
+// Sanitize an input message, separate from messageDefaults because
+// it must run before mentions are highlighted
+export function sanitizeText (msg) {
+  // Trim messages longer than the MAX_MESSAGE_LENGTH
+  return msg.substring(0, shared.constants.MAX_MESSAGE_LENGTH);
+}
+
 export function messageDefaults (msg, user, client, flagCount = 0, info = {}) {
   const id = uuid();
-  const trimmedMessage = msg.substring(0, 3000);
   const message = {
     id,
     _id: id,
-    text: trimmedMessage,
-    unformattedText: removeMd(trimmedMessage),
+    text: msg,
+    unformattedText: removeMd(msg),
     info,
     timestamp: Number(new Date()),
     likes: {},

website/server/models/user/methods.js

@@ -110,7 +110,7 @@ schema.methods.getObjectionsToInteraction = function getObjectionsToInteraction
 
 
 /**
- * Sends a message to a this. Archives a copy in sender's inbox.
+ * Sends a message to a user. Archives a copy in sender's inbox.
  *
  * @param  userToReceiveMessage  The receiver
  * @param  options