Added sanity checks for private chat message string

Author: dingodoppelt

src/serverrpc.cpp

@@ -47,6 +47,9 @@
 
 #include "serverrpc.h"
 
+/* Definitions ****************************************************************/
+#define INVALID_CLIENT_ID -1
+
 CServerRpc::CServerRpc ( CServer* pServer, CRpcServer* pRpcServer, QObject* parent ) : QObject ( parent )
 {
     // API doc already part of CClientRpc
@@ -299,15 +302,17 @@ CServerRpc::CServerRpc ( CServer* pServer, CRpcServer* pRpcServer, QObject* pare
     /// @param {number} params.id - The client's channel id.
     /// @result {string} result - Always "ok".
     pRpcServer->HandleMethod ( "jamulusserver/privateChatMessage", [=] ( const QJsonObject& params, QJsonObject& response ) {
-        auto      jsonChatMessage = params["chatMessage"];
-        const int id              = params["id"].toInt();
-        if ( !jsonChatMessage.isString() )
+        auto          jsonChatMessage = params["chatMessage"];
+        const int     id              = params["id"].toInt ( INVALID_CLIENT_ID );
+        const QString chatMessage     = jsonChatMessage.toString();
+        if ( chatMessage.isEmpty() || chatMessage.size() > MAX_LEN_CHAT_TEXT )
         {
-            response["error"] = CRpcServer::CreateJsonRpcError ( CRpcServer::iErrInvalidParams, "Invalid params: chatMessage is not a string" );
+            response["error"] =
+                CRpcServer::CreateJsonRpcError ( CRpcServer::iErrInvalidParams, "Invalid params: chatMessage is not a string or malformed" );
             return;
         }
 
-        if ( pServer->SendChatTextToConChannel ( id, jsonChatMessage.toString() ) )
+        if ( pServer->SendChatTextToConChannel ( id, chatMessage ) )
         {
             response["error"] = "invalid channel ID";
             return;