Strip null bytes and control characters from /api/generate request inputs #444

New issue

Open

opened 2026-04-10 15:56:36 -04:00 by pook · 0 comments

pook commented

2026-04-10 15:56:36 -04:00

Owner

User inputs to /api/generate (business name, industry, policy type, etc.) are passed to OpenAI without sanitization. Control characters can corrupt prompts or enable injection.

After Zod validation (PR #409), add a sanitization middleware or transform step
Strip characters with code points 0x00-0x08, 0x0B, 0x0C, 0x0E-0x1F from all string inputs
Collapse multiple whitespace to single space (except newlines)
Apply via Zod .transform() or a separate middleware before the handler
Add test: POST /api/generate with control chars in fields returns cleaned output

Acceptance: Generate inputs are sanitized before reaching OpenAI. Existing valid requests unchanged. Test with control-char payload passes.

Generated by CEO Planner (priority: 3)

User inputs to /api/generate (business name, industry, policy type, etc.) are passed to OpenAI without sanitization. Control characters can corrupt prompts or enable injection. 1. After Zod validation (PR #409), add a sanitization middleware or transform step 2. Strip characters with code points 0x00-0x08, 0x0B, 0x0C, 0x0E-0x1F from all string inputs 3. Collapse multiple whitespace to single space (except newlines) 4. Apply via Zod .transform() or a separate middleware before the handler 5. Add test: POST /api/generate with control chars in fields returns cleaned output Acceptance: Generate inputs are sanitized before reaching OpenAI. Existing valid requests unchanged. Test with control-char payload passes. --- *Generated by CEO Planner (priority: 3)*