Sanitize user input

Author: Eddasol

api/Controllers/InspectionRecordController.cs

@@ -182,6 +182,19 @@ public async Task<ActionResult<InspectionRecord>> Create(
         [FromBody] CreateInspectionRecordRequest request
     )
     {
+        request.RequiredAnalysis = request.RequiredAnalysis is not null
+            ? Sanitize.SanitizeUserInput(request.RequiredAnalysis)
+            : null;
+        if (request.AnalysisGroup is not null)
+        {
+            request.AnalysisGroup.AnalysisGroupId = Sanitize.SanitizeUserInput(
+                request.AnalysisGroup.AnalysisGroupId
+            );
+            request.AnalysisGroup.AnalysisGroupAnalyses = Sanitize.SanitizeUserInput(
+                request.AnalysisGroup.AnalysisGroupAnalyses
+            );
+        }
+
         try
         {
             var created = await inspectionRecordService.CreateAndTrigger(request);

api/Controllers/ThermalReferenceMetadataController.cs

@@ -1,6 +1,7 @@
 using api.Controllers.Models;
 using api.Database.Models;
 using api.Services;
+using api.Utilities;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
@@ -70,6 +71,10 @@ public async Task<ActionResult<ThermalReferenceMetadata>> CreateThermalReference
         [FromBody] ThermalReferenceMetadataInput input
     )
     {
+        input.InstallationCode = Sanitize.SanitizeUserInput(input.InstallationCode);
+        input.TagId = Sanitize.SanitizeUserInput(input.TagId);
+        input.InspectionDescription = Sanitize.SanitizeUserInput(input.InspectionDescription);
+
         try
         {
             var (imageLocation, polygonLocation) = BuildReferenceLocations(

api/Utilities/SanitizedInput.cs

@@ -9,6 +9,11 @@ public static string SanitizeUserInput(string inputString)
             return inputString.Replace("\n", "").Replace("\r", "");
         }
 
+        public static List<string> SanitizeUserInput(List<string> inputList)
+        {
+            return inputList.Select(SanitizeUserInput).ToList();
+        }
+
         public static FetchCO2MeasurementRequest SanitizeUserInput(
             FetchCO2MeasurementRequest inputQuery
         )