psa-systems/mokosh-apps
Watch
9
0
Fork
You've already forked mokosh-apps
 0
Code Issues Pull requests 1 Projects Releases 14 Packages Wiki Activity Actions

feat(contacts): validate Website field and cap text fields on company form #216

Merged
nrupard merged 2 commits from feat/mapps-213-company-form-website-validation into main 2026-06-16 16:18:55 +02:00
Conversation 0 Commits 2 Files changed 3 +174 -37
David commented 2026-06-16 15:34:05 +02:00
Owner
Copy link

The New Company form accepted any Website value (including javascript:/data:/vbscript: and malformed URLs) client-side and only failed as an opaque "Request failed with status: 422" with no field highlight. Free-text fields also accepted unbounded input.

Add validate_website_field: blank stays optional, otherwise require an explicit http/https scheme and a non-empty host, rejecting dangerous schemes and malformed URLs at the field before any request. Scheme detection is factored into a shared utils::url::scheme_of (reused by safe_href) so the field validator rejects the same whitespace tricks (java\tscript:) that render-time href sanitization guards against.

Add a maxlength prop to the Input component and apply server-matching caps to Company Name (255, mirrors CreateCompanyRequest.name), Industry, Website, and the address text fields (255), Postal Code (12), and Country (2).

Surface server field errors: the typed API layer now carries the 422 envelope's per-field errors, and the company form maps a server "website" rejection onto the Website field instead of only showing the generic banner (MAPPS-210).

#MAPPS-213

The New Company form accepted any Website value (including javascript:/data:/vbscript: and malformed URLs) client-side and only failed as an opaque "Request failed with status: 422" with no field highlight. Free-text fields also accepted unbounded input. Add validate_website_field: blank stays optional, otherwise require an explicit http/https scheme and a non-empty host, rejecting dangerous schemes and malformed URLs at the field before any request. Scheme detection is factored into a shared utils::url::scheme_of (reused by safe_href) so the field validator rejects the same whitespace tricks (java\tscript:) that render-time href sanitization guards against. Add a maxlength prop to the Input component and apply server-matching caps to Company Name (255, mirrors CreateCompanyRequest.name), Industry, Website, and the address text fields (255), Postal Code (12), and Country (2). Surface server field errors: the typed API layer now carries the 422 envelope's per-field errors, and the company form maps a server "website" rejection onto the Website field instead of only showing the generic banner (MAPPS-210). #MAPPS-213
feat(contacts): validate Website field and cap text fields on company form
All checks were successful
Check / clippy + fmt + tests (pull_request) Successful in 58s
Details
eb66616569 
The New Company form accepted any Website value (including javascript:/data:/vbscript: and malformed URLs) client-side and only failed as an opaque "Request failed with status: 422" with no field highlight. Free-text fields also accepted unbounded input.

Add validate_website_field: blank stays optional, otherwise require an explicit http/https scheme and a non-empty host, rejecting dangerous schemes and malformed URLs at the field before any request. Scheme detection is factored into a shared utils::url::scheme_of (reused by safe_href) so the field validator rejects the same whitespace tricks (java\tscript:) that render-time href sanitization guards against.

Add a maxlength prop to the Input component and apply server-matching caps to Company Name (255, mirrors CreateCompanyRequest.name), Industry, Website, and the address text fields (255), Postal Code (12), and Country (2).

Surface server field errors: the typed API layer now carries the 422 envelope's per-field errors, and the company form maps a server "website" rejection onto the Website field instead of only showing the generic banner (MAPPS-210).

#MAPPS-213
Merge remote-tracking branch 'origin/main' into feat/mapps-213-company-form-website-validation
All checks were successful
Check / clippy + fmt + tests (pull_request) Successful in 1m0s
Details
Create release / Create release from merged PR (pull_request) Has been skipped
Details
75d6dfd4ae 
# Conflicts:
#	src/components/form.rs
#	src/hooks/fetch.rs
nrupard deleted branch feat/mapps-213-company-form-website-validation 2026-06-16 16:18:55 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
psa-systems/mokosh-apps!216
No description provided.