Skip to content

[Bug] useSignupForm.ts: communityName and communityBio Zod schemas have minimum length but no maximum length, accepting arbitrarily long strings #129

@anshul23102

Description

@anshul23102

Bug Summary

signupSchema in src/features/Auth/v1/hooks/useSignupForm.ts validates communityName and communityBio with only minimum length constraints:

communityName: z.string().min(2, "Community name must be at least 2 characters"),
communityBio: z.string().min(10, "Bio must be at least 10 characters"),

No max() constraint is set on either field. A user can submit a community name or bio containing thousands of characters. These values are sent to the backend via submitCommunitySignup:

await fetch("/api/v1/auth/signup-community", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify(data),
});

Without server-side enforcement, a frontend-only length cap can be trivially bypassed by sending the request directly. But even within the app, there is no frontend cap, so the Zod validation passes for strings of any length.

Oversized communityName values will be stored in the database and rendered in UI elements (headers, sidebars, dropdowns) that may not have CSS overflow protection, causing layout corruption. Oversized communityBio values inflate database storage and may exceed column width limits silently depending on the backend ORM.

Expected Behavior

communityName should have a practical maximum (for example, 100 characters) and communityBio should have a maximum matching the UI text area size (for example, 500 characters).

Actual Behavior

Both fields accept strings of any length and pass validation.

Affected File

src/features/Auth/v1/hooks/useSignupForm.ts, signupSchema


@NexGenStudioDev I would like to work on this issue. Could you please assign/ it to me? Contributing under NSoC '26.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions