search

UKHomeOfficeForms / hof

Bootstrap a HOF project
MIT License
15 stars 17 forks source link

HOF-25 - Added sanitsation middleware and appropriate tests #297

Closed MCrawleyHomeOffice closed 2 years ago

MCrawleyHomeOffice commented 2 years ago

What? In order to move away from using naxsi rules we need to sanitise the user input before saving it to session

Why? Naxsi is a sledgehammer which we've had to disable many rules so our users don't get problems. Instead we're going to add new sanitisation rules that will manipulate the user input if they enter something we don't like to avoid possible SQL injection and other attacks.

How? Added a new middleware in the base-controller called _sanitization() which will loop our user inputs and modify them accrdingly.

Testing? Unit tests and linting tests.

Screenshots (optional) N/A

Anything Else? Rules for what we have agreed to do for each unwanted string are detailed on the original ticket - HOF-25.

MCrawleyHomeOffice commented 2 years ago

Were you able to test this on a service?

Yes, it was tested on firearms and NRM using the acceptance tests.