CRITICAL: Unvalidated JSON parsing from LLM response

[CPAtoCybersecurity]

Security Finding

Severity: CRITICAL
Location: src/pages/DocumentUpload.js:169-171
CWE: CWE-20 (Improper Input Validation)

Description

JSON responses from the LLM are parsed and used without schema validation. This could allow injection of unexpected data structures into application state.

Current Code

const jsonMatch = response.match(/\{[\s\S]*\}/);
if (jsonMatch) {
  const parsed = JSON.parse(jsonMatch[0]);  // No schema validation
  setDocumentAnalysis(parsed);
}

Recommended Fix

1. Define expected schema using zod or joi
2. Validate parsed JSON against schema before use
3. Sanitize all string fields
4. Implement allowlist of expected properties
5. Add type checking for all fields

References

• Arcanum Anti-Patterns: Missing Input Validation (Priority Implement Basic User Authentication #6)
• OWASP: Injection

---

Found by Arcanum sec-context security review