cozie-app / cozie-apple

https://cozie-apple.app
GNU Lesser General Public License v3.0
15 stars 9 forks source link

Sanitize user inputs #45

Open mariofrei opened 2 years ago

mariofrei commented 2 years ago

Is your feature request related to a problem? Please describe. User inputs (e.g., participant ID, experiment ID) should be sanitized in order to prevent malicious SQL injections.

Describe the solution you'd like Ideally, all inputs that are transferred to the database are sanitized in the Lambda function, i.e., special characters are removed.

Describe alternatives you've considered -

Additional context -

mariofrei commented 1 year ago

See:

mariofrei commented 2 months ago

In addition, some special characters need to be excluded from measurement names, tag keys, and field keys:

mariofrei commented 2 months ago

Input sanitization has been implemented on the backend. However, there should also be some feedback in the app UI that shows a warning when valid characters are used.