HIGH: Missing input validation on configuration fields

[CPAtoCybersecurity]

Security Finding

Severity: HIGH
Location: src/pages/Settings.js:72-80
CWE: CWE-20 (Improper Input Validation)

Description

Email and URL fields accept input without proper validation:

• No email format validation
• No URL scheme validation (could accept javascript: URLs)
• No length limits

Recommended Fix

1. Add regex validation for email format
2. Validate URL scheme (https:// only)
3. Add length limits on all inputs
4. Implement form validation library (zod recommended)

References

• Arcanum Anti-Patterns: Missing Input Validation (Priority Implement Basic User Authentication #6)
• OWASP: Input Validation

---

Found by Arcanum sec-context security review

[Sarthak-Bhagat2006]

Hi, I would like to work on this issue.
Could you please assign it to me?

[Sarthak-Bhagat2006]

I don’t see an email field in Settings.js. Should validation be added to framework edit fields or another settings section?

[CPAtoCybersecurity]

Good catch - you're right that Settings.js doesn't have a dedicated email field.

The input validation for this issue should go in the API configuration fields in the Settings page - specifically the Jira/Confluence integration section where users enter:

• Base URL (should validate URL format)
• Email (when/if added)
• API tokens (basic sanitization)

That said, looking at the current codebase, most of the sensitive config validation already happens server-side in server/validators/. The frontend validation would be more about UX - preventing obviously bad input before it hits the API.

If you want to tackle this, focus on the handleSaveConfig functions in Settings.js that deal with the Atlassian integration. Add basic format checks (valid URL, non-empty required fields) before the API call.

Your PR #83 just got merged btw - nice work on the error sanitization.