Missing String Length Constraints
Description:
Various creation and update endpoints (e.g., target policies, workflows, profiles) accept string inputs such as name and description without imposing any maximum length constraints.
Impact:
An attacker could submit excessively large payloads for these fields, resulting in database bloat, increased memory consumption on data retrieval, and potential application slowdowns.
Recommendation:
Introduce length validation (e.g., maximum 255 characters for name, maximum 2000 characters for description) either via Pydantic model Field constraints or explicit length checks in the route handlers before processing the data.
Missing String Length Constraints
Description:
Various creation and update endpoints (e.g., target policies, workflows, profiles) accept string inputs such as
nameanddescriptionwithout imposing any maximum length constraints.Impact:
An attacker could submit excessively large payloads for these fields, resulting in database bloat, increased memory consumption on data retrieval, and potential application slowdowns.
Recommendation:
Introduce length validation (e.g., maximum 255 characters for
name, maximum 2000 characters fordescription) either via Pydantic modelFieldconstraints or explicit length checks in the route handlers before processing the data.