unkeyed / unkey

Open source API management platform
https://go.unkey.com
Other
4.06k stars 475 forks source link

I can create a new API without a name #2510

Open Khaan25 opened 2 days ago

Khaan25 commented 2 days ago

Preliminary Checks

Reproduction / Replay Link (Optional)

No response

Issue Summary

I was testing the app core functionality. I found out that I can create a API without a name: image

Steps to Reproduce

  1. Go to https://app.unkey.com/apis
  2. Create a new API
  3. Enter spaces (spacebar)
  4. Click Create button

Expected behavior

This dialog form should have some sort of input validation and sanitation to valid the user data.

I follow "NEVER TRUST THE USER" :)

It should give some sort of error to enter a proper name, you can also use .trim() function to get rid of the spaces :) I can also solve this issue.

Other information

No response

Screenshots

See my cursor in the image: image

Version info

- OS: Windows
- Browser: Chrome
linear[bot] commented 2 days ago

ENG-1518 I can create a new API without a name

unrenamed commented 2 days ago

Same in the "Create New Key" form. You can use whitespaces only in most of the inputs. I think both can be fixed in one PR.

https://github.com/user-attachments/assets/5a9d34b6-05b6-42a0-8572-073c4f657cdb

unrenamed commented 2 days ago

The real challenge begins when you attempt to delete an API like that 😈

https://github.com/user-attachments/assets/41b8ecc4-0c95-4732-a5be-533ae88174a1

Khaan25 commented 2 days ago

💀

Khaan25 commented 2 days ago

@chronark I think this is a critical issue, I would like to work on it and make sure all inputs in the application are properly validated on frontend as well as the backend.

What do you say?

unrenamed commented 2 days ago

Please note that there may be conflicts with the open PRs addressing other input-related issues, such as this one: #2319. FMPOV, it's important to carefully validate the fixes before combining them into one.