Merge "Add string length limits"

diff --combined includes/api/ApiBase.php
index bf2b977,cb3c2f6..83d2ae9
--- 1/includes/api/ApiBase.php
--- 2/includes/api/ApiBase.php
+++ b/includes/api/ApiBase.php
@@@ -217,6 -217,18 +217,18 @@@ abstract class ApiBase extends ContextS
         */
        const PARAM_ISMULTI_LIMIT2 = 22;
  
+       /**
+        * (integer) Maximum length of a string in bytes (in UTF-8 encoding).
+        * @since 1.31
+        */
+       const PARAM_MAX_BYTES = 23;
+ 
+       /**
+        * (integer) Maximum length of a string in characters (unicode codepoints).
+        * @since 1.31
+        */
+       const PARAM_MAX_CHARS = 24;
+ 
        /**@}*/
  
        const ALL_DEFAULT_STRING = '*';
@@@ -1069,10 -1081,10 +1081,10 @@@
                        } else {
                                $type = 'NULL'; // allow everything
                        }
 +              }
  
 -                      if ( $type == 'password' || !empty( $paramSettings[self::PARAM_SENSITIVE] ) ) {
 -                              $this->getMain()->markParamsSensitive( $encParamName );
 -                      }
 +              if ( $type == 'password' || !empty( $paramSettings[self::PARAM_SENSITIVE] ) ) {
 +                      $this->getMain()->markParamsSensitive( $encParamName );
                }
  
                if ( $type == 'boolean' ) {
@@@ -1173,9 -1185,9 +1185,9 @@@
                        );
                }
  
-               // More validation only when choices were not given
-               // choices were validated in parseMultiValue()
                if ( isset( $value ) ) {
+                       // More validation only when choices were not given
+                       // choices were validated in parseMultiValue()
                        if ( !is_array( $type ) ) {
                                switch ( $type ) {
                                        case 'NULL': // nothing to do
@@@ -1285,6 -1297,23 +1297,23 @@@
                                $value = array_unique( $value );
                        }
  
+                       if ( in_array( $type, [ 'NULL', 'string', 'text', 'password' ], true ) ) {
+                               foreach ( (array)$value as $val ) {
+                                       if ( isset( $paramSettings[self::PARAM_MAX_BYTES] )
+                                               && strlen( $val ) > $paramSettings[self::PARAM_MAX_BYTES]
+                                       ) {
+                                               $this->dieWithError( [ 'apierror-maxbytes', $encParamName,
+                                                       $paramSettings[self::PARAM_MAX_BYTES] ] );
+                                       }
+                                       if ( isset( $paramSettings[self::PARAM_MAX_CHARS] )
+                                               && mb_strlen( $val, 'UTF-8' ) > $paramSettings[self::PARAM_MAX_CHARS]
+                                       ) {
+                                               $this->dieWithError( [ 'apierror-maxchars', $encParamName,
+                                                       $paramSettings[self::PARAM_MAX_CHARS] ] );
+                                       }
+                               }
+                       }
+ 
                        // Set a warning if a deprecated parameter has been passed
                        if ( $deprecated && $value !== false ) {
                                $feature = $encParamName;

diff --combined includes/api/ApiHelp.php
index ea4f724,02404c4..529b32c
--- 1/includes/api/ApiHelp.php
--- 2/includes/api/ApiHelp.php
+++ b/includes/api/ApiHelp.php
@@@ -62,7 -62,6 +62,7 @@@ class ApiHelp extends ApiBase 
                if ( $params['wrap'] ) {
                        $data = [
                                'mime' => 'text/html',
 +                              'filename' => 'api-help.html',
                                'help' => $html,
                        ];
                        ApiResult::setSubelementsList( $data, 'help' );
@@@ -71,7 -70,6 +71,7 @@@
                        $result->reset();
                        $result->addValue( null, 'text', $html, ApiResult::NO_SIZE_CHECK );
                        $result->addValue( null, 'mime', 'text/html', ApiResult::NO_SIZE_CHECK );
 +                      $result->addValue( null, 'filename', 'api-help.html', ApiResult::NO_SIZE_CHECK );
                }
        }
  
@@@ -713,6 -711,15 +713,15 @@@
                                                }
                                        }
  
+                                       if ( isset( $settings[self::PARAM_MAX_BYTES] ) ) {
+                                               $info[] = $context->msg( 'api-help-param-maxbytes' )
+                                                       ->numParams( $settings[self::PARAM_MAX_BYTES] );
+                                       }
+                                       if ( isset( $settings[self::PARAM_MAX_CHARS] ) ) {
+                                               $info[] = $context->msg( 'api-help-param-maxchars' )
+                                                       ->numParams( $settings[self::PARAM_MAX_CHARS] );
+                                       }
+ 
                                        // Add default
                                        $default = isset( $settings[ApiBase::PARAM_DFLT] )
                                                ? $settings[ApiBase::PARAM_DFLT]