RealDevSquad / RealDevSquad/website-backend
Sanitize query string before using it in DB service
Open
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 74
- Forks
- 276
- Avg merge
- 1d 26m
- Merged PRs (30d)
- 14
Description
Directly using the query string provided from UI may be dangerous. We should sanitize it, before sending it to our DB service.
Originally posted by @ankushdharkar in https://github.com/Real-Dev-Squad/website-backend/pull/1067#discussion_r1184992221
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the backend endpoint that accepts the UI query string, then trace where it is passed to the DB service. Review the project’s existing query handling and security tests before deciding the appropriate sanitization boundary. Done means unsafe input is handled safely without breaking valid queries, with regression coverage.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, nodejs
- Domain
- api, backend, database
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100