Improper input validation in emoji field leads to sidebar UI denial of service

Summary: The emoji field in the page emoji update endpoint does not properly validate user input. An attacker can submit an excessively long string including newline characters instead of a valid emoji. By injecting long text and line breaks, the sidebar layout becomes broken. As a result, the …

PUT /ocs/v2.php/apps/collectives/api/v1.0/p/collectives/{collective_id}/pages/{page_id}/emoji
Content-Type: application/json

Example payload:

{
  "emoji": "👍aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\naaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
}