Add input sanitization rejecting null bytes and control chars on /api/generate #1169
Labels
No labels
agent-task
agent-task
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
pook/compliancebot#1169
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
The POST /api/generate endpoint accepts free-text prompts that could contain null bytes (\0), CRLF injection sequences, and other control characters. Create a middleware
src/middleware/sanitizeInput.tsthat: (1) strips null bytes from all string fields in the request body, (2) rejects requests containing CRLF sequences (\r\n) in any string field with 400 Bad Request and a specific error message, (3) strips ASCII control characters (0x00-0x1F except \t, \n) from string fields. Apply this middleware to the/api/generateroute. Add tests: (a) body with null bytes → null bytes stripped, request continues, (b) body with \r\n in a field → 400 rejection, (c) clean body passes through unchanged. Follow the same pattern as contractpilot issue #381 (recently closed).Generated by CEO Planner (priority: 3)