Skip to content

deploy: feedback widget enforces the server's screenshot and body caps - #478

Open
Cimos wants to merge 2 commits into
cimos-feedback-widget-browser-testfrom
cimos-feedback-widget-screenshot-caps
Open

Cimos wants to merge 2 commits into
cimos-feedback-widget-browser-testfrom
cimos-feedback-widget-screenshot-caps

Conversation

@Cimos

@Cimos Cimos commented Nov 6, 2026

Copy link
Copy Markdown
Owner

Fixes #477. Stacked on #475.

The demo feedback widget had no client-side limits, so a 9th screenshot, an image over 8 MiB, or a body over 16 MiB got a 413 from the feedback server (#411).

  • Attach (paste / drop / file picker): refuses images past MAX_SHOTS (8), over MAX_SHOT_BYTES (8 MiB), or that would push attachments past the MAX_BODY (16 MiB) budget. A visible #etfb-err message (role=alert) names each refused file and the reason. Non-images that are dropped or picked are now reported too. Slots are reserved while files are read, so parallel reads can't go over a limit.
  • Send: checks the exact UTF-8 size of the body. If it's over MAX_BODY, nothing is sent and the user sees a message. Send also waits for any reads still in progress. If the auto-captured canvas is too large, it is skipped and the toast says so.
  • MAX_* values in the JS mirror etchy-server.py. A unit test checks that they match.
  • Browser tests cover all three attach paths, the 8 MiB boundary, the body budget on attach and on send, and the canvas skip. Before the fix, 7 of the new tests fail.

No CHANGELOG entry (deploy-only).

Cimos and others added 2 commits November 6, 2026 22:44
#477)

Paste, drop and the file picker refuse a 9th screenshot, an image over
8 MiB, or one that would push attachments past the 16 MiB body budget,
with a visible message naming the refused files. Send re-checks the whole
body and refuses with a message rather than getting a 413; an oversized
auto-captured canvas is skipped with a note in the toast. MAX_SHOTS,
MAX_SHOT_BYTES and MAX_BODY mirror etchy-server.py, checked by a unit test.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Review finding: an image added during the request was cleared by the
post-send reset without being sent or reported.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant