Insufficient Input Validation and Sanitization

[ColeMurray]

Summary

The application lacks comprehensive input validation and sanitization across all API endpoints, potentially allowing injection attacks, XSS, and data corruption.

Severity

HIGH

CWE Classification

• CWE-20: Improper Input Validation
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• CWE-129: Improper Validation of Array Index
• CWE-170: Improper Null Termination
• CWE-1284: Improper Validation of Specified Quantity in Input

Description

Multiple endpoints accept user input without proper validation:

1. No input sanitization for user display names, prompts, or text content
2. Missing length validation on text fields
3. No content type validation for expected data types
4. Special characters not escaped or validated
5. No rate limiting on input-heavy endpoints

This affects all route files and could lead to various security vulnerabilities.

Impact

• Cross-Site Scripting (XSS) attacks
• SQL injection (in combination with other vulnerabilities)
• Buffer overflow or memory exhaustion
• Data corruption
• Denial of Service through large inputs
• Stored XSS in conversation history

Affected Files

• /pickleglass_web/backend_node/routes/user.js
• /pickleglass_web/backend_node/routes/conversations.js
• /pickleglass_web/backend_node/routes/presets.js
• /src/app/ApiKeyHeader.js (client-side validation missing)

Examples of Vulnerable Code

1. User Profile Update (No validation)

// routes/user.js - VULNERABLE
router.put('/profile', (req, res) => {
    const { displayName } = req.body;
    if (!displayName) return res.status(400).json({ error: 'displayName is required' });
    
    // No length check, no sanitization!
    db.prepare("UPDATE users SET display_name = ? WHERE uid = ?").run(displayName, req.uid);
    res.json({ message: 'Profile updated successfully' });
});

2. Preset Creation (No validation)

// routes/presets.js - VULNERABLE
router.post('/', (req, res) => {
    const { title, prompt } = req.body;
    if (!title || !prompt) {
        return res.status(400).json({ error: 'Title and prompt are required' });
    }
    
    // No validation on content or length!
    db.prepare(
        `INSERT INTO prompt_presets (id, uid, title, prompt, is_default, created_at, sync_state)
         VALUES (?, ?, ?, ?, 0, ?, 'dirty')`
    ).run(presetId, req.uid, title, prompt, now);
});

---

This issue has been automatically identified by Waclaude security scanner

[DarellBoyle]

Do all endpoints skip validation, or just specific user-facing ones?

[samtiz]

Thanks for pointing out. Currently it works only on local DB, also moved all db access from pickleglass_web/backend_node to electron main process. So I think it's fine for now.