Skip to content

fix: Add input validation and proper HTTP status codes to Flask API e…#180

Closed
aparnatonni wants to merge 1 commit into
c2siorg:mainfrom
aparnatonni:fix/backend-input-validation
Closed

fix: Add input validation and proper HTTP status codes to Flask API e…#180
aparnatonni wants to merge 1 commit into
c2siorg:mainfrom
aparnatonni:fix/backend-input-validation

Conversation

@aparnatonni
Copy link
Copy Markdown

Add input validation and proper HTTP status codes to all API endpoints

  • Validate empty/null command inputs across 10 endpoints
  • Return proper status codes: 400 for bad input, 500 for errors
  • Wrap GDB execution in try/except blocks
  • Return structured JSON error responses

Fixes issue #144

…ndpoints

- Add validation for empty/null command inputs across all 10 endpoints
- Return proper HTTP status codes: 400 for bad input, 500 for server errors
- Wrap all GDB command execution in try/except blocks
- Return structured JSON error responses with status codes
- Improves security and reliability (resolves issue c2siorg#144)
@Uday9909
Copy link
Copy Markdown
Contributor

Hey, thanks for the PR! I've reviewed the changes, but we can't merge this as-is. It adds superficial validation but still leaves critical security vulnerabilities open.

Path Traversal (main.py:97-112): name is still used directly after a .strip(). This needs proper sanitization and must be restricted to a fixed output directory.

Command Injection (main.py:58-74 & 164-169): Both command and location are just checked for empty strings before execution/concatenation. This leaves injection vectors wide open. We need a strict allowlist or parser here.

We need to tackle this using a centralized validation and allowlist approach rather than duplicating string checks.

@Shubh942 — I recommend closing this PR for now until we establish a proper shared validation handler!

@Shubh942 Shubh942 closed this May 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants