{"record":{"id":"7356fa773397893b","repo":"dgtlmoon/changedetection.io","slug":"bounding-box-value-is-too-long","errorCode":null,"errorMessage":"Bounding box value is too long","messagePattern":"Bounding box value is too long","errorType":"validation","errorClass":"ValidationError","httpStatus":null,"severity":"warning","filePath":"changedetectionio/processors/image_ssim_diff/forms.py","lineNumber":19,"sourceCode":"\"\"\"\nConfiguration forms for fast screenshot comparison processor.\n\"\"\"\n\nfrom wtforms import SelectField, StringField, validators, ValidationError, IntegerField\nfrom flask_babel import lazy_gettext as _l\nfrom changedetectionio.forms import processor_text_json_diff_form\nimport re\n\nfrom changedetectionio.processors.image_ssim_diff import SCREENSHOT_COMPARISON_THRESHOLD_OPTIONS\n\n\ndef validate_bounding_box(form, field):\n    \"\"\"Validate bounding box format: x,y,width,height with integers.\"\"\"\n    if not field.data:\n        return  # Optional field\n\n    if len(field.data) > 100:\n        raise ValidationError(_l('Bounding box value is too long'))\n\n    # Should be comma-separated integers\n    if not re.match(r'^\\d+,\\d+,\\d+,\\d+$', field.data):\n        raise ValidationError(_l('Bounding box must be in format: x,y,width,height (integers only)'))\n\n    # Validate values are reasonable (not negative, not ridiculously large)\n    parts = [int(p) for p in field.data.split(',')]\n    for part in parts:\n        if part < 0:\n            raise ValidationError(_l('Bounding box values must be non-negative'))\n        if part > 10000:  # Reasonable max screen dimension\n            raise ValidationError(_l('Bounding box values are too large'))\n\n\ndef validate_selection_mode(form, field):\n    \"\"\"Validate selection mode value.\"\"\"\n    if not field.data:\n        return  # Optional field","sourceCodeStart":1,"sourceCodeEnd":37,"githubUrl":"https://github.com/dgtlmoon/changedetection.io/blob/5d9c7c6da76340597243e8163c4f2439237fa0e8/changedetectionio/processors/image_ssim_diff/forms.py#L1-L37","documentation":"WTForms inline validator for the visual-diff bounding box field rejects any value longer than 100 characters before format checks run. It is a sanity guard against absurd inputs (and potential ReDoS/parse abuse) on a field that should only ever hold four comma-separated integers.","triggerScenarios":"Submitting the image-diff watch form with a bounding_box string longer than 100 chars, e.g. repeated coordinates, pasted coordinates with units/labels, or a pasted page fragment into the wrong field.","commonSituations":"Copy-paste from annotation tools that emit float or labelled coordinates ('x: 12, y: 34, w: ...'); users pasting into the wrong form field; automated form fills with garbage data.","solutions":["Enter only four comma-separated integers, e.g. 10,20,300,400","Copy the exact value produced by the browser-UI region selector rather than hand-transcribing coordinates","Trim whatever tool output you pasted down to the four numbers"],"exampleFix":"# before\nbounding_box = 'x: 10, y: 20, width: 300, height: 400'\n# after\nbounding_box = '10,20,300,400'","handlingStrategy":"validation","validationCode":"if len(bbox) > 100:\n    raise ValueError('bounding box too long — expected x,y,w,h integers')","typeGuard":"def is_plausible_bbox_string(s: str) -> bool:\n    return isinstance(s, str) and len(s) <= 100","tryCatchPattern":null,"preventionTips":["Only ever put four integers in the bounding box field","Use the built-in region selector UI rather than pasting external tool output"],"tags":["wtforms","validation","bounding-box","image-diff"],"backgroundTag":"form-validation-failed","analyzedSha":"5d9c7c6da76340597243e8163c4f2439237fa0e8","analyzedAt":"2026-08-27T19:41:16.067Z","schemaVersion":2},"datasetVersion":"2026-08-28T00:17:15.603Z"}