feat: Implement TagHtml sanitization and validation for tag creation and updates

frasermolyneux · frasermolyneux · commit d044a86d8cba · 2026-06-27T16:31:27.000+01:00
diff --git a/src/XtremeIdiots.Portal.Repository.Abstractions.V1/Constants/V1/ApiErrorCodes.cs b/src/XtremeIdiots.Portal.Repository.Abstractions.V1/Constants/V1/ApiErrorCodes.cs
@@ -17,6 +17,7 @@ public static class ApiErrorCodes
         public const string EntityConflict = "ENTITY_CONFLICT";
         public const string EntityIdMismatch = "ENTITY_ID_MISMATCH";
         public const string MissingEntityId = "MISSING_ENTITY_ID";
+        public const string InvalidTagHtml = "INVALID_TAG_HTML";
 
         // Deserialization Errors
         public const string DeserializationError = "DESERIALIZATION_ERROR";
diff --git a/src/XtremeIdiots.Portal.Repository.Abstractions.V1/Constants/V1/ApiErrorMessages.cs b/src/XtremeIdiots.Portal.Repository.Abstractions.V1/Constants/V1/ApiErrorMessages.cs
@@ -24,6 +24,7 @@ public static class ApiErrorMessages
 
         // Validation Error Messages
         public const string TagIdRequiredMessage = "TagId is required";
+        public const string InvalidTagHtmlMessage = "TagHtml contains unsupported markup";
         public const string PlayerIdMismatchMessage = "PlayerId in the URL must match PlayerId in the request body";
         public const string UserProfileIdMismatchMessage = "UserProfileId in the URL must match UserProfileId in the request body";
         public const string InvalidCutoffDateMessage = "Cutoff date was not provided or was invalid";
diff --git a/src/XtremeIdiots.Portal.Repository.Api.Tests.V1/Controllers/V1/TagsControllerTests.cs b/src/XtremeIdiots.Portal.Repository.Api.Tests.V1/Controllers/V1/TagsControllerTests.cs
@@ -1,6 +1,7 @@
 using System.Net;
 using Microsoft.Extensions.Caching.Memory;
 using Xunit;
+using XtremeIdiots.Portal.Repository.Abstractions.Constants.V1;
 using XtremeIdiots.Portal.Repository.Abstractions.Interfaces.V1;
 using XtremeIdiots.Portal.Repository.Abstractions.Models.V1.Tags;
 using XtremeIdiots.Portal.Repository.Api.Tests.V1.TestHelpers;
@@ -72,6 +73,48 @@ public async Task CreateTag_CreatesEntity()
         Assert.Single(context.Tags);
     }
 
+    [Fact]
+    public async Task CreateTag_WithUnsafeTagHtml_ReturnsBadRequest()
+    {
+        using var context = DbContextHelper.CreateInMemoryContext();
+        var controller = CreateController(context);
+        var api = (ITagsApi)controller;
+
+        var tagDto = new TagDto
+        {
+            TagId = Guid.NewGuid(),
+            Name = "UnsafeTag",
+            TagHtml = "<img src=x onerror=alert(1)>"
+        };
+
+        var result = await api.CreateTag(tagDto);
+
+        Assert.Equal(HttpStatusCode.BadRequest, result.StatusCode);
+        Assert.Empty(context.Tags);
+        Assert.Equal(ApiErrorCodes.InvalidTagHtml, result.Result?.Errors?.FirstOrDefault()?.Code);
+    }
+
+    [Fact]
+    public async Task CreateTag_WithValidTagHtml_SanitizesAndCreatesEntity()
+    {
+        using var context = DbContextHelper.CreateInMemoryContext();
+        var controller = CreateController(context);
+        var api = (ITagsApi)controller;
+
+        var tagDto = new TagDto
+        {
+            TagId = Guid.NewGuid(),
+            Name = "ValidTag",
+            TagHtml = "<span class=\"badge bg-warning\"><i class=\"fa-solid fa-shield\"></i> Moderate Chat</span>"
+        };
+
+        var result = await api.CreateTag(tagDto);
+
+        Assert.Equal(HttpStatusCode.Created, result.StatusCode);
+        var created = Assert.Single(context.Tags);
+        Assert.Equal("<span class=\"badge bg-warning\"><i class=\"fa-solid fa-shield\"></i> Moderate Chat</span>", created.TagHtml);
+    }
+
     [Fact]
     public async Task UpdateTag_WithValidId_ReturnsOk()
     {
@@ -89,6 +132,71 @@ public async Task UpdateTag_WithValidId_ReturnsOk()
         Assert.Equal(HttpStatusCode.OK, result.StatusCode);
     }
 
+    [Fact]
+    public async Task UpdateTag_WithUnsafeTagHtml_ReturnsBadRequestAndDoesNotChangeStoredTagHtml()
+    {
+        using var context = DbContextHelper.CreateInMemoryContext();
+        var tagId = Guid.NewGuid();
+        context.Tags.Add(new Tag
+        {
+            TagId = tagId,
+            Name = "Original",
+            TagHtml = "<span class=\"badge bg-primary\">Original</span>"
+        });
+        await context.SaveChangesAsync();
+
+        var controller = CreateController(context);
+        var api = (ITagsApi)controller;
+
+        var tagDto = new TagDto
+        {
+            TagId = tagId,
+            Name = "Updated",
+            TagHtml = "<script>alert('xss')</script>"
+        };
+
+        var result = await api.UpdateTag(tagDto);
+
+        Assert.Equal(HttpStatusCode.BadRequest, result.StatusCode);
+        Assert.Equal(ApiErrorCodes.InvalidTagHtml, result.Result?.Errors?.FirstOrDefault()?.Code);
+
+        var unchanged = await context.Tags.FindAsync(tagId);
+        Assert.NotNull(unchanged);
+        Assert.Equal("<span class=\"badge bg-primary\">Original</span>", unchanged.TagHtml);
+    }
+
+    [Fact]
+    public async Task UpdateTag_WithEmptyTagHtml_ClearsStoredTagHtml()
+    {
+        using var context = DbContextHelper.CreateInMemoryContext();
+        var tagId = Guid.NewGuid();
+        context.Tags.Add(new Tag
+        {
+            TagId = tagId,
+            Name = "Original",
+            TagHtml = "<span class=\"badge bg-primary\">Original</span>"
+        });
+        await context.SaveChangesAsync();
+
+        var controller = CreateController(context);
+        var api = (ITagsApi)controller;
+
+        var tagDto = new TagDto
+        {
+            TagId = tagId,
+            Name = "Updated",
+            TagHtml = "   "
+        };
+
+        var result = await api.UpdateTag(tagDto);
+
+        Assert.Equal(HttpStatusCode.OK, result.StatusCode);
+
+        var updated = await context.Tags.FindAsync(tagId);
+        Assert.NotNull(updated);
+        Assert.Null(updated.TagHtml);
+    }
+
     [Fact]
     public async Task UpdateTag_WithInvalidId_ReturnsNotFound()
     {
diff --git a/src/XtremeIdiots.Portal.Repository.Api.Tests.V1/Validation/TagHtmlSanitizerTests.cs b/src/XtremeIdiots.Portal.Repository.Api.Tests.V1/Validation/TagHtmlSanitizerTests.cs
@@ -0,0 +1,54 @@
+using XtremeIdiots.Portal.Repository.Api.V1.Validation;
+using Xunit;
+
+namespace XtremeIdiots.Portal.Repository.Api.Tests.V1.Validation;
+
+public class TagHtmlSanitizerTests
+{
+    [Fact]
+    public void TrySanitize_WithValidSpanAndIcon_ReturnsSanitizedHtml()
+    {
+        const string input = "<span class=\"badge bg-warning\"><i class=\"fa-solid fa-shield\"></i> Moderate Chat</span>";
+
+        var isValid = TagHtmlSanitizer.TrySanitize(input, out var sanitized, out var error);
+
+        Assert.True(isValid);
+        Assert.Null(error);
+        Assert.Equal("<span class=\"badge bg-warning\"><i class=\"fa-solid fa-shield\"></i> Moderate Chat</span>", sanitized);
+    }
+
+    [Fact]
+    public void TrySanitize_WithScriptMarkup_ReturnsFalse()
+    {
+        const string input = "<script>alert('xss')</script>";
+
+        var isValid = TagHtmlSanitizer.TrySanitize(input, out var sanitized, out var error);
+
+        Assert.False(isValid);
+        Assert.NotNull(error);
+        Assert.Equal(input, sanitized);
+    }
+
+    [Fact]
+    public void TrySanitize_WithInvalidClassToken_ReturnsFalse()
+    {
+        const string input = "<span class=\"badge bg-warning()\">Test</span>";
+
+        var isValid = TagHtmlSanitizer.TrySanitize(input, out _, out var error);
+
+        Assert.False(isValid);
+        Assert.NotNull(error);
+    }
+
+    [Fact]
+    public void TrySanitize_WithPlainLabelSpecialCharacters_EncodesLabel()
+    {
+        const string input = "<span class=\"badge bg-warning\">A & B</span>";
+
+        var isValid = TagHtmlSanitizer.TrySanitize(input, out var sanitized, out var error);
+
+        Assert.True(isValid);
+        Assert.Null(error);
+        Assert.Equal("<span class=\"badge bg-warning\">A &amp; B</span>", sanitized);
+    }
+}
diff --git a/src/XtremeIdiots.Portal.Repository.Api.V1/Controllers/V1/TagsController.cs b/src/XtremeIdiots.Portal.Repository.Api.V1/Controllers/V1/TagsController.cs
@@ -13,6 +13,7 @@
 using XtremeIdiots.Portal.Repository.Abstractions.Interfaces.V1;
 using XtremeIdiots.Portal.Repository.Abstractions.Models.V1.Tags;
 using XtremeIdiots.Portal.Repository.Api.V1.Mapping;
+using XtremeIdiots.Portal.Repository.Api.V1.Validation;
 using MX.Api.Abstractions;
 using MX.Api.Web.Extensions;
 using XtremeIdiots.Portal.Repository.Abstractions.Constants.V1;
@@ -181,6 +182,17 @@ public async Task<IActionResult> CreateTag([FromBody] TagDto tagDto, Cancellatio
         /// <returns>An API result indicating the tag was created.</returns>
         async Task<ApiResult> ITagsApi.CreateTag(TagDto tagDto, CancellationToken cancellationToken)
         {
+            if (!TagHtmlSanitizer.TrySanitize(tagDto.TagHtml, out var sanitizedTagHtml, out var tagHtmlError))
+            {
+                var error = string.IsNullOrWhiteSpace(tagHtmlError)
+                    ? ApiErrorMessages.InvalidTagHtmlMessage
+                    : $"{ApiErrorMessages.InvalidTagHtmlMessage}. {tagHtmlError}";
+
+                return new ApiResponse(new ApiError(ApiErrorCodes.InvalidTagHtml, error)).ToBadRequestResult();
+            }
+
+            tagDto.TagHtml = sanitizedTagHtml;
+
             var tag = tagDto.ToEntity();
             context.Tags.Add(tag);
             await context.SaveChangesAsync(cancellationToken).ConfigureAwait(false);
@@ -225,7 +237,25 @@ async Task<ApiResult> ITagsApi.UpdateTag(TagDto tagDto, CancellationToken cancel
                 return new ApiResult(HttpStatusCode.NotFound);
             }
 
+            var hadTagHtmlInRequest = tagDto.TagHtml is not null;
+
+            if (!TagHtmlSanitizer.TrySanitize(tagDto.TagHtml, out var sanitizedTagHtml, out var tagHtmlError))
+            {
+                var error = string.IsNullOrWhiteSpace(tagHtmlError)
+                    ? ApiErrorMessages.InvalidTagHtmlMessage
+                    : $"{ApiErrorMessages.InvalidTagHtmlMessage}. {tagHtmlError}";
+
+                return new ApiResponse(new ApiError(ApiErrorCodes.InvalidTagHtml, error)).ToBadRequestResult();
+            }
+
+            tagDto.TagHtml = sanitizedTagHtml;
+
             tagDto.ApplyTo(tag);
+            if (hadTagHtmlInRequest && sanitizedTagHtml is null)
+            {
+                tag.TagHtml = null;
+            }
+
             await context.SaveChangesAsync(cancellationToken).ConfigureAwait(false);
             return new ApiResponse().ToApiResult();
         }
diff --git a/src/XtremeIdiots.Portal.Repository.Api.V1/Validation/TagHtmlSanitizer.cs b/src/XtremeIdiots.Portal.Repository.Api.V1/Validation/TagHtmlSanitizer.cs
@@ -0,0 +1,91 @@
+using System.Net;
+using System.Text.RegularExpressions;
+
+namespace XtremeIdiots.Portal.Repository.Api.V1.Validation;
+
+internal static partial class TagHtmlSanitizer
+{
+    private static readonly Regex SpanWithOptionalIconPattern = SpanWithOptionalIconRegex();
+    private static readonly Regex ClassTokenPattern = ClassTokenRegex();
+
+    public static bool TrySanitize(string? input, out string? sanitized, out string? error)
+    {
+        sanitized = input;
+        error = null;
+
+        if (input is null)
+        {
+            return true;
+        }
+
+        var trimmed = input.Trim();
+        if (trimmed.Length == 0)
+        {
+            sanitized = null;
+            return true;
+        }
+
+        var match = SpanWithOptionalIconPattern.Match(trimmed);
+        if (!match.Success)
+        {
+            error = "TagHtml must be a <span class=\"...\"> label, with an optional <i class=\"...\"></i> icon.";
+            return false;
+        }
+
+        var spanClasses = NormalizeClasses(match.Groups[1].Value);
+        if (spanClasses is null)
+        {
+            error = "TagHtml contains invalid CSS class names on the span element.";
+            return false;
+        }
+
+        var iconClassesRaw = match.Groups[2].Success ? match.Groups[3].Value : null;
+        var iconClasses = NormalizeClasses(iconClassesRaw);
+        if (iconClassesRaw is not null && iconClasses is null)
+        {
+            error = "TagHtml contains invalid CSS class names on the icon element.";
+            return false;
+        }
+
+        var label = WebUtility.HtmlEncode(match.Groups[4].Value.Trim());
+        if (string.IsNullOrWhiteSpace(label))
+        {
+            error = "TagHtml must include non-empty label text.";
+            return false;
+        }
+
+        sanitized = iconClasses is null
+            ? $"<span class=\"{spanClasses}\">{label}</span>"
+            : $"<span class=\"{spanClasses}\"><i class=\"{iconClasses}\"></i> {label}</span>";
+
+        return true;
+    }
+
+    private static string? NormalizeClasses(string? raw)
+    {
+        if (string.IsNullOrWhiteSpace(raw))
+        {
+            return null;
+        }
+
+        var tokens = raw
+            .Split(' ', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries)
+            .Distinct(StringComparer.Ordinal)
+            .ToList();
+
+        if (tokens.Count == 0 || tokens.Any(t => !ClassTokenPattern.IsMatch(t)))
+        {
+            return null;
+        }
+
+        return string.Join(' ', tokens);
+    }
+
+    [GeneratedRegex(
+        "^<span\\s+class=\"([^\"]+)\"\\s*>\\s*(<i\\s+class=\"([^\"]+)\"\\s*><\\/i>\\s*)?([^<>]+?)\\s*<\\/span>$",
+        RegexOptions.IgnoreCase | RegexOptions.CultureInvariant)]
+    private static partial Regex SpanWithOptionalIconRegex();
+
+    [GeneratedRegex("^[a-zA-Z0-9_-]+$", RegexOptions.CultureInvariant)]
+    private static partial Regex ClassTokenRegex();
+}
