Summary
Several user inputs aren't validated server-side, so garbage values persist and break downstream logic, and overlong strings 500 on a varchar overflow.
Details
- Priority is only validated in
BulkUpdate. IssueService.Create and Update assign priority verbatim, and the column is VARCHAR(30), so a >30-char value 500s and any short garbage value is stored and breaks priority filtering/sorting.
- State group:
StateService.Update validates against validStateGroups, but Create accepts any string (defaulting only when empty), so a state can be created with group: "foobar" that never matches a group query.
- String max-length is missing across most create/update bodies (they use
binding:"required" with no max). The columns are bounded (state name/color VARCHAR(255), project name, workspace name, issue name), so overlong input reaches Postgres and errors as 22001 -> 500. The max= pattern is used in the auth handlers, so it's known but applied inconsistently.
- No DB
CHECK constraints exist on any enum-like column (network, access, role, state group, priority, sync kind/state), so there's no backstop when app-side validation is missed.
Suggested fix
Validate priority and state group on create as well as update, add max length binding (or service-side caps) on user string fields, and consider adding CHECK constraints for the enum columns.
Summary
Several user inputs aren't validated server-side, so garbage values persist and break downstream logic, and overlong strings 500 on a varchar overflow.
Details
BulkUpdate.IssueService.CreateandUpdateassignpriorityverbatim, and the column isVARCHAR(30), so a >30-char value 500s and any short garbage value is stored and breaks priority filtering/sorting.StateService.Updatevalidates againstvalidStateGroups, butCreateaccepts any string (defaulting only when empty), so a state can be created withgroup: "foobar"that never matches a group query.binding:"required"with nomax). The columns are bounded (state name/colorVARCHAR(255), project name, workspace name, issue name), so overlong input reaches Postgres and errors as 22001 -> 500. Themax=pattern is used in the auth handlers, so it's known but applied inconsistently.CHECKconstraints exist on any enum-like column (network, access, role, state group, priority, sync kind/state), so there's no backstop when app-side validation is missed.Suggested fix
Validate priority and state group on create as well as update, add
maxlength binding (or service-side caps) on user string fields, and consider adding CHECK constraints for the enum columns.