fix(contacts): validate company create/update input to 422 not 500

David commented

2026-06-14 15:37:48 +02:00

Owner

Fuzzing POST /api/v1/contacts/companies surfaced inputs that passed the application layer, failed in Postgres, and leaked as HTTP 500 DATABASE_ERROR. Validate them at the request-model layer so bad input never reaches the DB and returns 422 instead.

Add request-layer validators in mokosh-types::contacts and apply them to CreateCompanyRequest and UpdateCompanyRequest (the sibling endpoint shares the columns and the same 500 class): name is rejected when whitespace-only or containing control characters (which includes NUL); website is bounded to the VARCHAR(255) column size and must be an http/https URL, blocking javascript:/data: schemes that drive the stored XSS in MAPPS-149; all other scalar text fields, nested Address fields, and tags reject NUL bytes that Postgres text/varchar columns cannot store.

#PMS-297

Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com

Fuzzing POST /api/v1/contacts/companies surfaced inputs that passed the application layer, failed in Postgres, and leaked as HTTP 500 DATABASE_ERROR. Validate them at the request-model layer so bad input never reaches the DB and returns 422 instead. Add request-layer validators in mokosh-types::contacts and apply them to CreateCompanyRequest and UpdateCompanyRequest (the sibling endpoint shares the columns and the same 500 class): name is rejected when whitespace-only or containing control characters (which includes NUL); website is bounded to the VARCHAR(255) column size and must be an http/https URL, blocking javascript:/data: schemes that drive the stored XSS in MAPPS-149; all other scalar text fields, nested Address fields, and tags reject NUL bytes that Postgres text/varchar columns cannot store. #PMS-297 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

David added 1 commit

2026-06-14 15:37:49 +02:00

fix(contacts): validate company create/update input to 422 not 500

E2E / Playwright against staging (pull_request) Successful in 51s

Details

Check / fmt + clippy + compile + unit/doc tests (pull_request) Successful in 1m14s

Details

Integration / integration tests (pull_request) Successful in 5m15s

Details

fe9cf7a666

Fuzzing POST /api/v1/contacts/companies surfaced inputs that passed the application layer, failed in Postgres, and leaked as HTTP 500 DATABASE_ERROR. Validate them at the request-model layer so bad input never reaches the DB and returns 422 instead.

Add request-layer validators in mokosh-types::contacts and apply them to CreateCompanyRequest and UpdateCompanyRequest (the sibling endpoint shares the columns and the same 500 class): name is rejected when whitespace-only or containing control characters (which includes NUL); website is bounded to the VARCHAR(255) column size and must be an http/https URL, blocking javascript:/data: schemes that drive the stored XSS in MAPPS-149; all other scalar text fields, nested Address fields, and tags reject NUL bytes that Postgres text/varchar columns cannot store.

#PMS-297

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

David added 1 commit

2026-06-14 15:55:10 +02:00

Merge branch 'main' into fix/pms-297-company-create-validation

Create release / Create release from merged PR (pull_request) Has been skipped

Details

Check / fmt + clippy + compile + unit/doc tests (pull_request) Successful in 1m29s

Details

E2E / Playwright against staging (pull_request) Successful in 2m24s

Details

Integration / integration tests (pull_request) Successful in 6m35s

Details

19a57505de