From 2c165e4817054f60cf50d7eecb492a57d24d7c2a Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@koston.org>
Date: Thu, 8 Jan 2026 20:36:08 -1000
Subject: [PATCH] [web_server] Use centralized length constants for buffer
 sizing (#13073)

---
 esphome/components/web_server/web_server.cpp | 12 +++++++-----
 esphome/core/config.py                       | 13 ++++++++++---
 esphome/core/entity_base.h                   |  9 ++++++++-
 3 files changed, 25 insertions(+), 9 deletions(-)

diff --git a/esphome/components/web_server/web_server.cpp b/esphome/components/web_server/web_server.cpp
index e5705d7b47..cab177c182 100644
--- a/esphome/components/web_server/web_server.cpp
+++ b/esphome/components/web_server/web_server.cpp
@@ -498,14 +498,16 @@ static void set_json_id(JsonObject &root, EntityBase *obj, const char *prefix, J
 
   // Build id into stack buffer - ArduinoJson copies the string
   // Format: {prefix}/{device?}/{name}
-  // Buffer size guaranteed by schema validation (NAME_MAX_LENGTH=120):
-  //   With devices: domain(20) + "/" + device(120) + "/" + name(120) + null = 263, rounded up to 280 for safety margin
-  //   Without devices: domain(20) + "/" + name(120) + null = 142, rounded up to 150 for safety margin
+  // Buffer sizes use constants from entity_base.h validated in core/config.py
+  // Note: Device name uses ESPHOME_FRIENDLY_NAME_MAX_LEN (sub-device max 120), not ESPHOME_DEVICE_NAME_MAX_LEN
+  // (hostname)
 #ifdef USE_DEVICES
-  char id_buf[280];
+  static constexpr size_t ID_BUF_SIZE =
+      ESPHOME_DOMAIN_MAX_LEN + 1 + ESPHOME_FRIENDLY_NAME_MAX_LEN + 1 + ESPHOME_FRIENDLY_NAME_MAX_LEN + 1;
 #else
-  char id_buf[150];
+  static constexpr size_t ID_BUF_SIZE = ESPHOME_DOMAIN_MAX_LEN + 1 + ESPHOME_FRIENDLY_NAME_MAX_LEN + 1;
 #endif
+  char id_buf[ID_BUF_SIZE];
   char *p = id_buf;
   memcpy(p, prefix, prefix_len);
   p += prefix_len;
diff --git a/esphome/core/config.py b/esphome/core/config.py
index b7e6ab9bee..21ed8ced1a 100644
--- a/esphome/core/config.py
+++ b/esphome/core/config.py
@@ -184,17 +184,24 @@ if "ESPHOME_DEFAULT_COMPILE_PROCESS_LIMIT" in os.environ:
 else:
     _compile_process_limit_default = cv.UNDEFINED
 
+# Keep in sync with ESPHOME_FRIENDLY_NAME_MAX_LEN in esphome/core/entity_base.h
+FRIENDLY_NAME_MAX_LEN = 120
+
 AREA_SCHEMA = cv.Schema(
     {
         cv.GenerateID(CONF_ID): cv.declare_id(Area),
-        cv.Required(CONF_NAME): cv.All(cv.string_no_slash, cv.Length(max=120)),
+        cv.Required(CONF_NAME): cv.All(
+            cv.string_no_slash, cv.Length(max=FRIENDLY_NAME_MAX_LEN)
+        ),
     }
 )
 
 DEVICE_SCHEMA = cv.Schema(
     {
         cv.GenerateID(CONF_ID): cv.declare_id(Device),
-        cv.Required(CONF_NAME): cv.All(cv.string_no_slash, cv.Length(max=120)),
+        cv.Required(CONF_NAME): cv.All(
+            cv.string_no_slash, cv.Length(max=FRIENDLY_NAME_MAX_LEN)
+        ),
         cv.Optional(CONF_AREA_ID): cv.use_id(Area),
     }
 )
@@ -210,7 +217,7 @@ CONFIG_SCHEMA = cv.All(
             cv.Required(CONF_NAME): cv.valid_name,
             # Keep max=120 in sync with OBJECT_ID_MAX_LEN in esphome/core/entity_base.h
             cv.Optional(CONF_FRIENDLY_NAME, ""): cv.All(
-                cv.string_no_slash, cv.Length(max=120)
+                cv.string_no_slash, cv.Length(max=FRIENDLY_NAME_MAX_LEN)
             ),
             cv.Optional(CONF_AREA): validate_area_config,
             cv.Optional(CONF_COMMENT): cv.All(cv.string, cv.Length(max=255)),
diff --git a/esphome/core/entity_base.h b/esphome/core/entity_base.h
index 1649077dd0..5f75872a0f 100644
--- a/esphome/core/entity_base.h
+++ b/esphome/core/entity_base.h
@@ -16,7 +16,14 @@ namespace esphome {
 // Maximum device name length - keep in sync with validate_hostname() in esphome/core/config.py
 static constexpr size_t ESPHOME_DEVICE_NAME_MAX_LEN = 31;
 
-// Maximum size for object_id buffer - keep in sync with friendly_name cv.Length(max=120) in esphome/core/config.py
+// Maximum friendly name length for entities and sub-devices - keep in sync with FRIENDLY_NAME_MAX_LEN in
+// esphome/core/config.py
+static constexpr size_t ESPHOME_FRIENDLY_NAME_MAX_LEN = 120;
+
+// Maximum domain length (longest: "alarm_control_panel" = 19)
+static constexpr size_t ESPHOME_DOMAIN_MAX_LEN = 20;
+
+// Maximum size for object_id buffer (friendly_name + null + margin)
 static constexpr size_t OBJECT_ID_MAX_LEN = 128;
 
 enum EntityCategory : uint8_t {