From 0f430661371782a0d750c2b043a41fd2fd091a7e Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 7 Sep 2026 09:53:01 +0000
Subject: [PATCH] Validate saved wallpaper URLs

Co-authored-by: mroxso <24775431+mroxso@users.noreply.github.com>
---
 src/apps/settings/WallpaperSection.test.tsx | 3 +++
 src/apps/settings/index.tsx                 | 5 +++++
 2 files changed, 8 insertions(+)

diff --git a/src/apps/settings/WallpaperSection.test.tsx b/src/apps/settings/WallpaperSection.test.tsx
index 5ed0afc..df2a4e7 100644
--- a/src/apps/settings/WallpaperSection.test.tsx
+++ b/src/apps/settings/WallpaperSection.test.tsx
@@ -42,8 +42,10 @@ let instances: FakeImage[] = [];
 
 describe('WallpaperSection', () => {
   let originalImage: typeof Image;
+  let originalResizeObserver: typeof ResizeObserver;
 
   beforeEach(() => {
+    originalResizeObserver = global.ResizeObserver;
     global.ResizeObserver = StubResizeObserver as unknown as typeof ResizeObserver;
     instances = [];
     originalImage = globalThis.Image;
@@ -52,6 +54,7 @@ describe('WallpaperSection', () => {
 
   afterEach(() => {
     globalThis.Image = originalImage;
+    global.ResizeObserver = originalResizeObserver;
   });
 
   it('shows the dot-grid curated wallpaper selected by default', async () => {
diff --git a/src/apps/settings/index.tsx b/src/apps/settings/index.tsx
index d2c431b..8d47758 100644
--- a/src/apps/settings/index.tsx
+++ b/src/apps/settings/index.tsx
@@ -221,6 +221,10 @@ export function WallpaperSection() {
       toast({ title: 'Preview the image before saving it', variant: 'destructive' });
       return;
     }
+    if (previewedUrl.length > MAX_WALLPAPER_URL_LENGTH) {
+      toast({ title: 'That URL is too long', description: `URLs must be ${MAX_WALLPAPER_URL_LENGTH} characters or fewer.`, variant: 'destructive' });
+      return;
+    }
     updateConfig((current) => ({
       ...current,
       wallpaper: { version: 1, selection: { source: 'url', url: previewedUrl, presentation: { fit, dim } } },
@@ -271,6 +275,7 @@ export function WallpaperSection() {
       const tags = await uploadFile(sanitizedFile);
       const uploadedUrl = tags.find(([name, value]) => name === 'url' && value)?.[1];
       if (!uploadedUrl || !isSafeWallpaperUrl(uploadedUrl)) throw new Error('Upload did not return a safe image URL.');
+      if (uploadedUrl.length > MAX_WALLPAPER_URL_LENGTH) throw new Error(`Upload returned a URL longer than ${MAX_WALLPAPER_URL_LENGTH} characters.`);
 
       setUrlDraft(uploadedUrl);
       setPendingPreviewUrl(uploadedUrl);