Openshift(?): Add class-validators to dryRun input DTOs
- Dominant language
- TypeScript
- Stars
- 29
- Forks
- 15
- PR merge metrics
- No merged PRs in 30d
Description
There are some DTOs that are not validated and their properties are decorated with `@Allow()` because the properties are sent to Formio in the dryRun process. An attacker could send very large value in those DTOs trying to crash it. Even those DTOs can have some kind of length restriction to avoid it e.g.: EducationProgramAPIInDTO
![image.png]
***Acceptance Criteria***
- [ ] Find DTOs with `@Allow()` only and find their maximum lengths in the DB;
- [ ] Add `@ArrayMaxSize()` to arrays;
Contributor guide
No contributing guide indexed for this repository
Research direction
Search the DTOs for properties using only @Allow(), including EducationProgramAPIInDTO, and compare their maximum lengths with the database constraints. Review the dryRun input path that sends these properties to Formio, then verify that applicable arrays have @ArrayMaxSize() and all identified values are bounded according to the acceptance criteria.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100