Request Sanitizing Middleware - #354
Conversation
ed95b99 to
4743856
Compare
f7a3c7e to
5217279
Compare
Server-side request forger - https://github.com/bcgov/nr-permitconnect-navigator-service/security/code-scanning/34 Still showing as a one even after uuid check, leaving check but codeql/copilot is missing context here and it isn't the risk it thinks it is as it's a 3rd party api and they're handling the risk.
5217279 to
21785b5
Compare
There was a problem hiding this comment.
Pull Request Overview
This PR implements middleware to sanitize incoming request bodies by removing null characters from string values. The PR addresses a security concern where users might copy and paste null characters into form inputs, which could cause issues in downstream processing.
- Adds request sanitization middleware that recursively strips null characters from string values in request bodies
- Includes comprehensive test coverage for the new sanitization functionality
- Updates related documentation and removes unused service methods
Reviewed Changes
Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| app/src/middleware/requestSanitizer.ts | Implements the main middleware function to sanitize request bodies |
| app/src/middleware/utils.ts | Contains utility functions for null character removal and recursive sanitization |
| app/app.ts | Integrates the sanitization middleware into the Express application |
| app/tests/unit/middleware/requestSanitizer.test.ts | Comprehensive tests for the request sanitizer middleware |
| app/tests/unit/middleware/utils.test.ts | Unit tests for the sanitization utility functions |
| app/tests/unit/utils/utils.test.ts | New comprehensive test suite for utility functions |
| app/src/utils/utils.ts | Updates JSDoc comments and adds UUID validation function |
| app/src/services/coms.ts | Removes getObjects method and adds validation to getObject |
| app/src/controllers/roadmap.ts | Updates to use individual object calls instead of bulk getObjects |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
21785b5 to
65ee5bb
Compare
|
|



Description
Implemented middleware that will sanitize string inputs to remove any unwanted null characters in case users copy and past them into inputs.
Types of changes
Bug fix (non-breaking change which fixes an issue)
Checklist
Further comments
Also added some utility function testings and change to ts docs