_⚠️ Potential issue_ | _🟠 Major_

[chitcommit]

⚠️ Potential issue | 🟠 Major

Missing input validation for investigation creation.

The request body is passed directly to createInvestigation without schema validation. This could allow invalid or malicious data to be inserted.

Consider using the insertForensicInvestigationSchema from the shared schema to validate input:

+import { insertForensicInvestigationSchema } from "@shared/schema";

   api.post("/forensics/investigations", async (req: Request, res: Response) => {
     try {
       const user = await storage.getUserByUsername("demo");
       if (!user) {
         return res.status(404).json({ message: "User not found" });
       }

+      const validationResult = insertForensicInvestigationSchema.safeParse({
+        ...req.body,
+        userId: user.id
+      });
+      if (!validationResult.success) {
+        return res.status(400).json({ message: "Invalid investigation data", errors: validationResult.error.errors });
+      }
+
-      const investigation = await createInvestigation({
-        ...req.body,
-        userId: user.id
-      });
+      const investigation = await createInvestigation(validationResult.data);

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

import { insertForensicInvestigationSchema } from "@shared/schema";

  // Create new investigation
  api.post("/forensics/investigations", async (req: Request, res: Response) => {
    try {
      const user = await storage.getUserByUsername("demo");
      if (!user) {
        return res.status(404).json({ message: "User not found" });
      }

      const validationResult = insertForensicInvestigationSchema.safeParse({
        ...req.body,
        userId: user.id
      });
      if (!validationResult.success) {
        return res.status(400).json({ message: "Invalid investigation data", errors: validationResult.error.errors });
      }

      const investigation = await createInvestigation(validationResult.data);

      res.status(201).json(investigation);
    } catch (error) {
      console.error("Error creating investigation:", error);
      res.status(500).json({ message: "Failed to create investigation" });
    }
  });

🤖 Prompt for AI Agents

In server/routes.ts around lines 538 to 556, the POST handler for creating
investigations accepts req.body directly which lacks validation; import and use
the shared insertForensicInvestigationSchema to validate (e.g., safeParse or
parse) the incoming payload before calling createInvestigation, return a 400
with validation errors if invalid, and only call createInvestigation with the
validated data merged with userId; ensure you handle and log validation failures
separately from unexpected server errors.

Originally posted by @coderabbitai[bot] in #5 (comment)

[chitcommit]

Auto-closed: Bot/automated issue cleanup