Fix: Validate country field against numeric input (Issue #1301) - #1435
Fix: Validate country field against numeric input (Issue #1301)#1435sahare77 wants to merge 1 commit into
Conversation
📝 WalkthroughWalkthrough
ChangesProfile validation
Estimated code review effort: 1 (Trivial) | ~5 minutes Possibly related issues
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@backend/controllers/authController.js`:
- Around line 431-434: Update the country validation in the relevant auth
controller flow to normalize the input and require membership in the supported
two-letter country-code allowlist, rather than accepting arbitrary alphabetic
names or punctuation. Perform this validation before assigning user.country, and
preserve the existing 400 response for unsupported values.
- Around line 431-434: Update the country validation in the auth controller to
require that country is a string, trim it, and reject the normalized value when
empty or when it fails the existing countryRegex validation. Assign the
normalized trimmed string to user.country rather than the original input, while
preserving the current invalid-request response.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 986d77f7-eca4-4b67-9583-4681df851370
📒 Files selected for processing (1)
backend/controllers/authController.js
| if (country !== undefined && country !== "") { | ||
| const countryRegex = /^[a-zA-Z\s\-]+$/; | ||
| if (!countryRegex.test(country)) { | ||
| return res.status(400).json({ success: false, message: "Invalid country name provided" }); |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Validate supported two-letter country codes, not arbitrary names.
The regex accepts values such as "United States", "US-", and "ZZ". The PR objective states that downstream APIs expect supported two-letter country codes. This validation can still persist values that cause invalid API calls. Normalize the value and validate it against the supported country-code allowlist before assigning user.country at Line 447.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@backend/controllers/authController.js` around lines 431 - 434, Update the
country validation in the relevant auth controller flow to normalize the input
and require membership in the supported two-letter country-code allowlist,
rather than accepting arbitrary alphabetic names or punctuation. Perform this
validation before assigning user.country, and preserve the existing 400 response
for unsupported values.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
node <<'NODE'
const countryRegex = /^[a-zA-Z\s\-]+$/;
for (const value of [false, ["US"], " ", "US"]) {
console.log(JSON.stringify(value), countryRegex.test(value));
}
NODERepository: Canopus-Labs/PrepPilot
Length of output: 204
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
file="backend/controllers/authController.js"
printf '%s\n' '--- relevant controller code ---'
sed -n '400,470p' "$file"
printf '%s\n' '--- country references in the controller ---'
rg -n -C 3 '\bcountry\b' "$file"Repository: Canopus-Labs/PrepPilot
Length of output: 3964
Require a string and reject blank whitespace.
countryRegex.test(country) coerces non-string values, and the controller assigns country directly to user.country. Require a string, trim it, reject an empty normalized value, validate it, and assign the normalized string.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@backend/controllers/authController.js` around lines 431 - 434, Update the
country validation in the auth controller to require that country is a string,
trim it, and reject the normalized value when empty or when it fails the
existing countryRegex validation. Assign the normalized trimmed string to
user.country rather than the original input, while preserving the current
invalid-request response.
1 participant
Summary of What Has Been Done
The profile form contains a "Country" input field that lacked strict validation on the backend. Users could submit arbitrary numeric data or special characters, which bypassed the schema and corrupted the database.
Changes Made
Impact it Made
Closes #1301
Updates
updateUserProfileto reject invalid country values before database operations. The validation accepts alphabetic characters, spaces, and hyphens. Numeric and special-character values return HTTP 400.