BG-005 · backend/api.py:134

Unsafe Input Handling

MEDIUM✓ FIXED

Vulnerability description

Request body is consumed without schema validation or length limits before processing.

Security impact

Malformed or oversized payloads reach business logic, causing unhandled exceptions and stack traces in responses.

Recommended remediation

Validate and normalize the payload against an explicit schema, and reject anything outside the contract.

Fix

Before

def create_report(payload):
    return Report.create(title=payload["title"], body=payload["body"])

After

def create_report(payload):
    data = ReportSchema().load(payload)  # raises ValidationError
    return Report.create(title=data["title"], body=data["body"])

Regression test

test_invalid_payload_returns_422

def test_invalid_payload_returns_422(client):
    resp = client.post("/api/reports", json={"title": 1})
    assert resp.status_code == 422

Affected file

backend/api.py

Line 134

Affected code path

POST /api/reports → api.create_report(request.json)

Verification result

✓Regression test generated
✓Test passed
✓Fix verified