dgtlmoon/changedetection.io · warning · ValidationError

Bounding box value is too long

Error message

Bounding box value is too long

What it means

WTForms inline validator for the visual-diff bounding box field rejects any value longer than 100 characters before format checks run. It is a sanity guard against absurd inputs (and potential ReDoS/parse abuse) on a field that should only ever hold four comma-separated integers.

Source

Thrown at changedetectionio/processors/image_ssim_diff/forms.py:19

"""
Configuration forms for fast screenshot comparison processor.
"""

from wtforms import SelectField, StringField, validators, ValidationError, IntegerField
from flask_babel import lazy_gettext as _l
from changedetectionio.forms import processor_text_json_diff_form
import re

from changedetectionio.processors.image_ssim_diff import SCREENSHOT_COMPARISON_THRESHOLD_OPTIONS


def validate_bounding_box(form, field):
    """Validate bounding box format: x,y,width,height with integers."""
    if not field.data:
        return  # Optional field

    if len(field.data) > 100:
        raise ValidationError(_l('Bounding box value is too long'))

    # Should be comma-separated integers
    if not re.match(r'^\d+,\d+,\d+,\d+$', field.data):
        raise ValidationError(_l('Bounding box must be in format: x,y,width,height (integers only)'))

    # Validate values are reasonable (not negative, not ridiculously large)
    parts = [int(p) for p in field.data.split(',')]
    for part in parts:
        if part < 0:
            raise ValidationError(_l('Bounding box values must be non-negative'))
        if part > 10000:  # Reasonable max screen dimension
            raise ValidationError(_l('Bounding box values are too large'))


def validate_selection_mode(form, field):
    """Validate selection mode value."""
    if not field.data:
        return  # Optional field

View on GitHub (pinned to 5d9c7c6da7)

Solutions

1. Enter only four comma-separated integers, e.g. 10,20,300,400
2. Copy the exact value produced by the browser-UI region selector rather than hand-transcribing coordinates
3. Trim whatever tool output you pasted down to the four numbers

Example fix

# before
bounding_box = 'x: 10, y: 20, width: 300, height: 400'
# after
bounding_box = '10,20,300,400'

if len(bbox) > 100:
    raise ValueError('bounding box too long — expected x,y,w,h integers')

def is_plausible_bbox_string(s: str) -> bool:
    return isinstance(s, str) and len(s) <= 100

When it happens

Trigger: Submitting the image-diff watch form with a bounding_box string longer than 100 chars, e.g. repeated coordinates, pasted coordinates with units/labels, or a pasted page fragment into the wrong field.

Common situations: Copy-paste from annotation tools that emit float or labelled coordinates ('x: 12, y: 34, w: ...'); users pasting into the wrong form field; automated form fills with garbage data.

Related errors

• Bounding box values are too large
• Bounding box must be in format: x,y,width,height (integers o
• Bounding box values must be non-negative
• RegEx '%s' is not a valid regular expression.
• Empty value not allowed.

AI-assisted analysis of dgtlmoon/changedetection.io@5d9c7c6da7 (2026-08-27). Data as JSON: /api/errors/7356fa773397893b. Report an issue: GitHub.