From 9058857506b60767e4220acbe769cd8a4505694d Mon Sep 17 00:00:00 2001
From: Thomas Kaul <4159106+dtslvr@users.noreply.github.com>
Date: Fri, 4 Sep 2026 09:12:15 +0200
Subject: [PATCH] Limit length for comment, search query and symbol

---
 .../data-providers/ghostfolio/get-lookup.dto.ts    | 14 ++++++++++++++
 .../ghostfolio/ghostfolio.controller.ts            |  5 ++---
 apps/api/src/app/symbol/get-lookup.dto.ts          | 14 ++++++++++++++
 apps/api/src/app/symbol/symbol.controller.ts       |  6 ++----
 4 files changed, 32 insertions(+), 7 deletions(-)
 create mode 100644 apps/api/src/app/endpoints/data-providers/ghostfolio/get-lookup.dto.ts
 create mode 100644 apps/api/src/app/symbol/get-lookup.dto.ts

diff --git a/apps/api/src/app/endpoints/data-providers/ghostfolio/get-lookup.dto.ts b/apps/api/src/app/endpoints/data-providers/ghostfolio/get-lookup.dto.ts
new file mode 100644
index 0000000000..e3aa726b4a
--- /dev/null
+++ b/apps/api/src/app/endpoints/data-providers/ghostfolio/get-lookup.dto.ts
@@ -0,0 +1,14 @@
+import { Transform, TransformFnParams } from 'class-transformer';
+import { IsBoolean, IsString, MaxLength } from 'class-validator';
+
+export class GetLookupDto {
+  @IsBoolean()
+  @Transform(({ value }: TransformFnParams) => {
+    return value === 'true';
+  })
+  includeIndices? = false;
+
+  @IsString()
+  @MaxLength(255)
+  query? = '';
+}
diff --git a/apps/api/src/app/endpoints/data-providers/ghostfolio/ghostfolio.controller.ts b/apps/api/src/app/endpoints/data-providers/ghostfolio/ghostfolio.controller.ts
index 4bdb84ea74..cd330f6911 100644
--- a/apps/api/src/app/endpoints/data-providers/ghostfolio/ghostfolio.controller.ts
+++ b/apps/api/src/app/endpoints/data-providers/ghostfolio/ghostfolio.controller.ts
@@ -32,6 +32,7 @@ import { getReasonPhrase, StatusCodes } from 'http-status-codes';
 
 import { GetDividendsDto } from './get-dividends.dto';
 import { GetHistoricalDto } from './get-historical.dto';
+import { GetLookupDto } from './get-lookup.dto';
 import { GetQuotesDto } from './get-quotes.dto';
 import { GhostfolioService } from './ghostfolio.service';
 
@@ -142,10 +143,8 @@ export class GhostfolioController {
   @UseGuards(AuthGuard('api-key'), HasPermissionGuard)
   @Version('2')
   public async lookupSymbol(
-    @Query('includeIndices') includeIndicesParam = 'false',
-    @Query('query') query = ''
+    @Query() { includeIndices, query }: GetLookupDto
   ): Promise<LookupResponse> {
-    const includeIndices = includeIndicesParam === 'true';
     await this.validateDailyRequestLimit();
 
     try {
diff --git a/apps/api/src/app/symbol/get-lookup.dto.ts b/apps/api/src/app/symbol/get-lookup.dto.ts
new file mode 100644
index 0000000000..e3aa726b4a
--- /dev/null
+++ b/apps/api/src/app/symbol/get-lookup.dto.ts
@@ -0,0 +1,14 @@
+import { Transform, TransformFnParams } from 'class-transformer';
+import { IsBoolean, IsString, MaxLength } from 'class-validator';
+
+export class GetLookupDto {
+  @IsBoolean()
+  @Transform(({ value }: TransformFnParams) => {
+    return value === 'true';
+  })
+  includeIndices? = false;
+
+  @IsString()
+  @MaxLength(255)
+  query? = '';
+}
diff --git a/apps/api/src/app/symbol/symbol.controller.ts b/apps/api/src/app/symbol/symbol.controller.ts
index d28362175e..9d8abb47ba 100644
--- a/apps/api/src/app/symbol/symbol.controller.ts
+++ b/apps/api/src/app/symbol/symbol.controller.ts
@@ -27,6 +27,7 @@ import { isValid, parseISO } from 'date-fns';
 import { StatusCodes, getReasonPhrase } from 'http-status-codes';
 import { isEmpty } from 'lodash';
 
+import { GetLookupDto } from './get-lookup.dto';
 import { SymbolService } from './symbol.service';
 
 @Controller('symbol')
@@ -43,11 +44,8 @@ export class SymbolController {
   @UseGuards(AuthGuard('jwt'), HasPermissionGuard)
   @UseInterceptors(TransformDataSourceInResponseInterceptor)
   public async lookupSymbol(
-    @Query('includeIndices') includeIndicesParam = 'false',
-    @Query('query') query = ''
+    @Query() { includeIndices, query }: GetLookupDto
   ): Promise<LookupResponse> {
-    const includeIndices = includeIndicesParam === 'true';
-
     try {
       return this.symbolService.lookup({
         includeIndices,