InputSanitizer exists but is never called from controllers #163

New Issue

2026-04-10T16:03:49+02:00

shahondin1624 commented

2026-04-10 16:03:49 +02:00

Severity: HIGH

Location

lib/Middleware/InputSanitizer.php, all controllers

Description

The InputSanitizer class provides sanitizeString(), sanitizeArray(), sanitizeDate(), etc., but no controller or service actually calls these methods. All user input from getRequestData() (JSON body) and $this->request->getParam() (query params) flows directly into services and database queries without sanitization.

Risk

While the ORM uses parameterized queries (preventing SQL injection), unsanitized strings are stored in the database. These could contain HTML/script payloads that, while currently escaped by Vue on render, could be exploited if data is ever rendered in a non-Vue context (e.g., emails, PDF exports, CalDAV sync).

Recommendation

Wire InputSanitizer into the ApiControllerTrait.getRequestData() method or apply it in service-layer create/update methods for all string fields.

## Severity: HIGH ## Location `lib/Middleware/InputSanitizer.php`, all controllers ## Description The `InputSanitizer` class provides `sanitizeString()`, `sanitizeArray()`, `sanitizeDate()`, etc., but no controller or service actually calls these methods. All user input from `getRequestData()` (JSON body) and `$this->request->getParam()` (query params) flows directly into services and database queries without sanitization. ## Risk While the ORM uses parameterized queries (preventing SQL injection), unsanitized strings are stored in the database. These could contain HTML/script payloads that, while currently escaped by Vue on render, could be exploited if data is ever rendered in a non-Vue context (e.g., emails, PDF exports, CalDAV sync). ## Recommendation Wire `InputSanitizer` into the `ApiControllerTrait.getRequestData()` method or apply it in service-layer `create`/`update` methods for all string fields.

shahondin1624 added the backend security priority:high labels 2026-04-10 16:03:49 +02:00

shahondin1624 referenced this issue from a commit

2026-04-10 16:12:48 +02:00

fix: wire InputSanitizer into ApiControllerTrait.getRequestData() (Closes #163)

shahondin1624 referenced a pull request that will close this issue

2026-04-10 16:13:04 +02:00

fix: wire InputSanitizer into ApiControllerTrait.getRequestData() (Closes #163) #176

shahondin1624 closed this issue

2026-04-10 16:13:09 +02:00

shahondin1624 referenced this issue from a commit

2026-04-10 16:13:09 +02:00

fix: wire InputSanitizer into ApiControllerTrait.getRequestData() (Closes #163) (#176)