Missing Validation for JSON Payload Contents
Description:
In backend/secuscan/routes.py, complex JSON fields are serialized into the database without verifying their schema or contents. For instance, _json_payload(payload.get("allowed_targets"), "[]") is used to store target lists.
Impact:
If an attacker provides an invalid structure (e.g., passing a string or object instead of a list of strings for allowed_targets), it will be blindly stored. Downstream components that rely on allowed_targets being a list might crash or behave unpredictably when they attempt to parse and use the invalid data.
Recommendation:
Validate complex nested fields inside the API handlers (or better, using Pydantic models) before serializing and saving them to the database. Ensure that allowed_targets is actually a list of valid URLs/hostnames, and that metadata, extra_headers, and login_recipe conform to their respective expected schemas.
Missing Validation for JSON Payload Contents
Description:
In
backend/secuscan/routes.py, complex JSON fields are serialized into the database without verifying their schema or contents. For instance,_json_payload(payload.get("allowed_targets"), "[]")is used to store target lists.Impact:
If an attacker provides an invalid structure (e.g., passing a string or object instead of a list of strings for
allowed_targets), it will be blindly stored. Downstream components that rely onallowed_targetsbeing a list might crash or behave unpredictably when they attempt to parse and use the invalid data.Recommendation:
Validate complex nested fields inside the API handlers (or better, using Pydantic models) before serializing and saving them to the database. Ensure that
allowed_targetsis actually a list of valid URLs/hostnames, and thatmetadata,extra_headers, andlogin_recipeconform to their respective expected schemas.