2026 06 10 Security Unsanitized API Input

Security: Unsanitized User Input in API Calls

Category: Security - Input Validation Effort: Low Priority: Medium Component: frontend/src/components/waste/WasteSearch/WasteSearchFiltersAdvanced/AdvancedFilterClientInput/index.tsx

---

Description

The onAutoCompleteChange handler passes user input (value) directly to the backend API without any validation or sanitization:

onAutoCompleteChange={async (value) =>
  (await APIs.forestclient.searchForestClients(value, 0, 10)).map(...)

This creates several risks:

1. API Abuse: Attackers could send crafted payloads to trigger excessive queries or resource exhaustion
2. Injection Attacks: If the backend doesn't properly sanitize, this could lead to SQL injection or NoSQL injection (depending on backend implementation)
3. Log Injection: Malicious input could corrupt logs or inject false entries

---

Suggested Fix

Option 1: Basic Input Sanitization (Recommended)

onAutoCompleteChange={async (value) => {
  // Sanitize input: trim whitespace and remove dangerous characters
  const sanitizedValue = value?.trim().replace(/[<>"'\]/g, '');
  if (!sanitizedValue) return [];
  return (await APIs.forestclient.searchForestClients(sanitizedValue, 0, 10)).map(
    forestClientAutocompleteResult2CodeDescription,
  );
}}

Option 2: Allow Only Alphanumeric and Basic Punctuation

onAutoCompleteChange={async (value) => {
  const sanitizedValue = value?.trim().replace(/[^a-zA-Z0-9\s\-.,()#]/g, '');
  if (!sanitizedValue || sanitizedValue.length < 2) return [];
  return (await APIs.forestclient.searchForestClients(sanitizedValue, 0, 10)).map(
    forestClientAutocompleteResult2CodeDescription,
  );
}}

Option 3: Add Minimum Length Check

onAutoCompleteChange={async (value) => {
  const searchTerm = value?.trim();
  if (!searchTerm || searchTerm.length < 2) return [];
  return (await APIs.forestclient.searchForestClients(searchTerm, 0, 10)).map(
    forestClientAutocompleteResult2CodeDescription,
  );
}}

---

Related Files

• frontend/src/components/waste/WasteSearch/WasteSearchFiltersAdvanced/AdvancedFilterClientInput/index.tsx
• Backend API: forestclient.searchForestClients endpoint (should also validate)

Testing

• Verify that special characters in search input don't break the UI or cause errors
• Confirm that very short queries (< 2 chars) don't trigger unnecessary API calls
• Test that the backend handles sanitized input correctly