Add 256-character length limit for annotation keys and values

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: chris-rock

pkg/annotations/annotations.go

@@ -29,9 +29,12 @@ func AnnotationArgs(annotations map[string]string) []string {
 	return args
 }
 
+const maxAnnotationLength = 256
+
 // Validate checks that annotation keys and values are well-formed for use as
-// cnspec --annotation key=value CLI arguments. Keys must be non-empty and must
-// not contain '='. Values must be non-empty.
+// cnspec --annotation key=value CLI arguments. Keys must be non-empty, must
+// not contain '=', and both keys and values must not exceed 256 characters.
+// Values must be non-empty.
 func Validate(annotations map[string]string) error {
 	for k, v := range annotations {
 		if k == "" {
@@ -40,9 +43,15 @@ func Validate(annotations map[string]string) error {
 		if strings.Contains(k, "=") {
 			return fmt.Errorf("annotation key %q must not contain '='", k)
 		}
+		if len(k) > maxAnnotationLength {
+			return fmt.Errorf("annotation key %q exceeds maximum length of %d characters", k, maxAnnotationLength)
+		}
 		if v == "" {
 			return fmt.Errorf("annotation value for key %q must not be empty", k)
 		}
+		if len(v) > maxAnnotationLength {
+			return fmt.Errorf("annotation value for key %q exceeds maximum length of %d characters", k, maxAnnotationLength)
+		}
 	}
 	return nil
 }

pkg/annotations/annotations_test.go

@@ -4,6 +4,7 @@
 package annotations
 
 import (
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -72,4 +73,28 @@ func TestValidate(t *testing.T) {
 		require.Error(t, err)
 		assert.Contains(t, err.Error(), "must not be empty")
 	})
+
+	t.Run("key at max length is valid", func(t *testing.T) {
+		longKey := strings.Repeat("k", 256)
+		assert.NoError(t, Validate(map[string]string{longKey: "value"}))
+	})
+
+	t.Run("key exceeding max length is rejected", func(t *testing.T) {
+		longKey := strings.Repeat("k", 257)
+		err := Validate(map[string]string{longKey: "value"})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "exceeds maximum length of 256")
+	})
+
+	t.Run("value at max length is valid", func(t *testing.T) {
+		longVal := strings.Repeat("v", 256)
+		assert.NoError(t, Validate(map[string]string{"key": longVal}))
+	})
+
+	t.Run("value exceeding max length is rejected", func(t *testing.T) {
+		longVal := strings.Repeat("v", 257)
+		err := Validate(map[string]string{"key": longVal})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "exceeds maximum length of 256")
+	})
 }