US-EPA-CAMD / easey-ui

Project Management repo for EPA Clean Air Markets Division (CAMD) Business Suite of applications
MIT License
0 stars 0 forks source link

Input Validation for CAMPD v1.5 API - `easey-account-api` #6416

Open spetros-do opened 1 month ago

spetros-do commented 1 month ago

Overview
The easey-account-api has been identified as lacking sufficient input validation. This ticket focuses on implementing input 
validation to ensure that all user inputs are correctly sanitized and parameterized to prevent injection attacks and invalid data submissions.

 Key Tasks
- Add input validation for account-related endpoints to ensure all inputs are properly sanitized and validated.
- Use decorators to enforce type validation (e.g., string or number) on all incoming data.
- Apply parameterized queries to mitigate the risk of SQL injection.
- Must write unit tests to validate that inputs are properly sanitized and verified.

 Acceptance Criteria
- All inputs must be validated for type, length, and content.
- Invalid inputs should trigger a `400 Bad Request` response with detailed error messages.
- SQL injection prevention should be enforced through parameterized queries.
- Unit tests must confirm that validation logic is correctly implemented across all inputs.
lgiannini1 commented 2 days ago