minimum length validation for invalid_response?(resp) method in Recaptcha module

[Akashkarmakar787]

Spammers can pass random value for the token param (ex: g-recaptcha-response) which can increase the API validation call to recaptcha, consequently incurring more cost.

Most of the Spam attacks we observed attacher sending 1-10 length chars.
It is good to have minimum length 100, validation check to avoid unnecessary API calls to recaptcha.

[grosser]

yeah that sounds reasonable,
I'd assume the spammers don't target the recaptcha specifically but just fill every form field
PR welcome

[Akashkarmakar787]

@grosser , you are correct. The spammers are not targeting the recaptcha specifically. They are trying to exploit XSS and CSRF attacks on the form fields. But it is increasing the recaptcha cost. Also I
observer cases where the attacker try to exploit the g-recaptcha-response params with XSS payloads.

[Akashkarmakar787]

@grosser I have raised the PR: #462