Enforce 65k character limit when attempting to update setting values.

src/Api/Controller/SetSettingsController.php

@@ -13,6 +13,8 @@
 use Flarum\Settings\Event;
 use Flarum\Settings\SettingsRepositoryInterface;
 use Illuminate\Contracts\Events\Dispatcher;
+use Illuminate\Contracts\Validation\Factory;
+use Illuminate\Validation\ValidationException;
 use Laminas\Diactoros\Response\EmptyResponse;
 use Psr\Http\Message\ResponseInterface;
 use Psr\Http\Message\ServerRequestInterface;
@@ -33,10 +35,11 @@ class SetSettingsController implements RequestHandlerInterface
     /**
      * @param SettingsRepositoryInterface $settings
      */
-    public function __construct(SettingsRepositoryInterface $settings, Dispatcher $dispatcher)
+    public function __construct(SettingsRepositoryInterface $settings, Dispatcher $dispatcher, Factory $validatorFactory)
     {
         $this->settings = $settings;
         $this->dispatcher = $dispatcher;
+        $this->validatorFactory = $validatorFactory;
     }
 
     /**
@@ -48,6 +51,17 @@ public function handle(ServerRequestInterface $request): ResponseInterface
 
         $settings = $request->getParsedBody();
 
+        $validation = $this->validatorFactory->make(
+            $settings,
+            array_map(function ($value) {
+                return 'max:65000';
+            }, $settings),
+        );
+
+        if ($validation->fails()) {
+            throw new ValidationException($validation);
+        }
+
         $this->dispatcher->dispatch(new Event\Saving($settings));
 
         foreach ($settings as $k => $v) {