OWASP / OWASP/Nest

Add Program/Module Tag Validation (Uniqueness & Alphanumeric Security)

Open
#3,503 1 comment 0 reactions 1 assignee Claimed by @HarshitVerma109 View on GitHub
enhancement frontend
Dominant language
Python
Stars
451
Forks
707
Avg merge
22h 59m
Merged PRs (30d)
91

Description

## 🎯 Issue Description

This issue addresses a security and data integrity gap in the Mentorship Portal where Program and Module tags currently lack validation. They can be duplicated and may contain potential security risks or inconsistent formatting.
Reference: https://github.com/OWASP/Nest/issues/2701

## 📋 Current Issues

1. **No Uniqueness Validation**: Tags can be duplicated within a single entry (e.g., `["python", "python"]`).
2. **No Format Security**: There is no restriction on tag characters, allowing special characters or potentially unsafe strings.
3. **Data Inconsistency**: Lack of standardization allows for mixed naming conventions (e.g., `["Python", "python"]`).

## 🛠️ Proposed Fix

- Update `CreateProgramInput`, `UpdateProgramInput`, `CreateModuleInput`, and `UpdateModuleInput` to implement validation logic for the `tags` field.
- Enforce uniqueness: Ensure the list of tags contains no duplicates.
- Enforce alphanumeric format: Restrict tags to `a-z`, `A-Z`, and `0-9` using regex validation.
- Add comprehensive unit tests to verify that invalid or duplicate tags are correctly rejected.

**Are you going to work on implementing this?**

- [x] Yes
- [ ] No

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.