bcgov / bcgov/SIMS

Openshift(?): Add class-validators to dryRun input DTOs

Open
#1,700 2 comments 0 reactions 0 assignees View on GitHub
Dev & Architecture Devops Task Technical Debt
Dominant language
TypeScript
Stars
29
Forks
15
PR merge metrics
No merged PRs in 30d

Description

There are some DTOs that are not validated and their properties are decorated with `@Allow()` because the properties are sent to Formio in the dryRun process. An attacker could send very large value in those DTOs trying to crash it. Even those DTOs can have some kind of length restriction to avoid it e.g.: EducationProgramAPIInDTO

![image.png](https://images.zenhubusercontent.com/601c6b4f5322cf5c519d503f/b71c4a3c-d06c-4821-aa6d-9915a1d8ebc5)![image.png]

***Acceptance Criteria***
- [ ] Find DTOs with `@Allow()` only and find their maximum lengths in the DB;
- [ ] Add `@ArrayMaxSize()` to arrays;

Contributor guide

No contributing guide indexed for this repository

Research direction

Search the DTOs for properties using only @Allow(), including EducationProgramAPIInDTO, and compare their maximum lengths with the database constraints. Review the dryRun input path that sends these properties to Formio, then verify that applicable arrays have @ArrayMaxSize() and all identified values are bounded according to the acceptance criteria.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.