{"record":{"id":"bb22c1292687780f","repo":"nextcloud/server","slug":"message-exceeds-allowed-character-limit-of-1000-bb22c1","errorCode":null,"errorMessage":"Message exceeds allowed character limit of 1000","messagePattern":"Message exceeds allowed character limit of 1000","errorType":"http","errorClass":"Sabre\\DAV\\Exception\\BadRequest","httpStatus":400,"severity":"error","filePath":"apps/dav/lib/Comments/CommentsPlugin.php","lineNumber":233,"sourceCode":"\t\t\tif (!is_null($user)) {\n\t\t\t\t$actorId = $user->getUID();\n\t\t\t}\n\t\t}\n\t\tif (is_null($actorId)) {\n\t\t\tthrow new BadRequest('Invalid actor \"' . $actorType . '\"');\n\t\t}\n\n\t\ttry {\n\t\t\t$comment = $this->commentsManager->create($actorType, $actorId, $objectType, $objectId);\n\t\t\t$comment->setMessage($data['message']);\n\t\t\t$comment->setVerb($data['verb']);\n\t\t\t$this->commentsManager->save($comment);\n\t\t\treturn $comment;\n\t\t} catch (\\InvalidArgumentException $e) {\n\t\t\tthrow new BadRequest('Invalid input values', 0, $e);\n\t\t} catch (MessageTooLongException $e) {\n\t\t\t$msg = 'Message exceeds allowed character limit of ';\n\t\t\tthrow new BadRequest($msg . IComment::MAX_MESSAGE_LENGTH, 0, $e);\n\t\t}\n\t}\n}\n","sourceCodeStart":215,"sourceCodeEnd":237,"githubUrl":"https://github.com/nextcloud/server/blob/ecdeb153ffdf227235c9a7e2d13dbe0f9c817bc3/apps/dav/lib/Comments/CommentsPlugin.php#L215-L237","documentation":"Comments are capped at IComment::MAX_MESSAGE_LENGTH, which is 1000 characters. Comment::setMessage() throws MessageTooLongException for longer strings, and the DAV plugin converts it into a 400 response that names the limit. The limit applies to the decoded message string, not to the raw request size.","triggerScenarios":"POST (create) or PUT (edit) of a comment whose message field exceeds 1000 characters after JSON decoding; multi-byte text is measured in characters, not bytes.","commonSituations":"Pasting long text into comment UIs; clients that count bytes instead of characters on UTF-8 content and therefore underestimate the length; concatenating templated messages client-side without a cap.","solutions":["Validate and cap the message to 1000 characters client-side before sending.","Split longer content into multiple comments, or store the long text elsewhere and post a short comment linking to it.","Use mb_strlen($message, 'UTF-8') so the client count matches the server's character-based count."],"exampleFix":"// before: HTTP 400 Message exceeds allowed character limit of 1000\n$payload['message'] = $userText;\n\n// after: cap at the server limit, counted in characters\n$max = 1000; // IComment::MAX_MESSAGE_LENGTH\n$payload['message'] = mb_strlen($userText, 'UTF-8') > $max\n    ? mb_substr($userText, 0, $max, 'UTF-8')\n    : $userText;","handlingStrategy":"validation","validationCode":"$max = 1000; // IComment::MAX_MESSAGE_LENGTH\nif (mb_strlen($payload['message'], 'UTF-8') > $max) {\n    $payload['message'] = mb_substr($payload['message'], 0, $max, 'UTF-8');\n    // or reject: throw new MessageTooLongClientError();\n}","typeGuard":null,"tryCatchPattern":"try {\n    $client->request('POST', $commentsUrl, $body);\n} catch (ClientHttpException $e) {\n    if ($e->getResponse()->getStatusCode() === 400\n        && str_contains($e->getResponse()->getBody()->getContents(), 'character limit')) {\n        $payload['message'] = mb_substr($payload['message'], 0, 1000, 'UTF-8');\n        $client->request('POST', $commentsUrl, json_encode($payload));\n    }\n}","preventionTips":["Show a live character counter capped at 1000 in comment UIs.","Count characters with mb_strlen, not bytes, on UTF-8 content.","Cap templated/generated message text before submission."],"tags":["dav","comments","validation","length-limit"],"backgroundTag":"message-too-long","analyzedSha":"ecdeb153ffdf227235c9a7e2d13dbe0f9c817bc3","analyzedAt":"2026-08-17T01:36:13.386Z","schemaVersion":2},"datasetVersion":"2026-08-17T04:17:16.089Z"}