Sanitize and validate user input before file write in actions.py

[semgrep-code-studentsca023-rgb]

Fix security vulnerability where user-controlled request data was written directly to files without validation or sanitization.

Changes

• Added a 10KB size limit on text input to prevent disk space exhaustion attacks
• Added sanitization to filter text to only printable characters and common whitespace (\n, \r, \t)
• Updated file write to use sanitized text instead of raw user input

Why

The original code passed request.form.get("text") directly to open_file.write(), allowing malicious actors to:

1. Exhaust disk space by submitting very large payloads (denial-of-service)
2. Write potentially malicious control characters to files

The fix validates input size and sanitizes content before writing, ensuring request data is properly escaped and validated.

Semgrep Finding Details

Found user-controlled request data passed into '.write(...)'. This could be dangerous if a malicious actor is able to control data into sensitive files. For example, a malicious actor could force rolling of critical log files, or cause a denial-of-service by using up available disk space. Instead, ensure that request data is properly escaped or sanitized.

@267212124 requested Semgrep Assistant generate this pull request to fix a finding from the detection rule python.django.security.injection.request-data-write.request-data-write.

---

⚠️ Review carefully before merging. This PR was generated by AI and may cause breaking changes or introduce new vulnerabilities.