feat(security): add comprehensive input validation and sanitization (#172)

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

app/api/files.py

@@ -21,6 +21,7 @@ from app.tasks.process_document import process_document
 from app.utils.file_queries import apply_status_filter
 from app.utils.file_status import get_files_processing_status
 from app.utils.filename_utils import sanitize_filename
+from app.utils.input_validation import validate_search_query, validate_sort_field, validate_sort_order
 
 # Set up logging
 logger = logging.getLogger(__name__)
@@ -77,6 +78,11 @@ def list_files_api(
       }
     }
     """
+    # Validate and sanitize query parameters
+    validate_sort_field(sort_by)
+    validate_sort_order(sort_order)
+    search = validate_search_query(search)
+
     # Start with base query
     query = db.query(FileRecord)
 

app/api/logs.py

@@ -12,6 +12,7 @@ from sqlalchemy.orm import Session
 from app.auth import require_login
 from app.database import get_db
 from app.models import FileRecord, ProcessingLog
+from app.utils.input_validation import validate_task_id
 
 # Set up logging
 logger = logging.getLogger(__name__)
@@ -59,6 +60,7 @@ def list_processing_logs(
     if file_id is not None:
         query = query.filter(ProcessingLog.file_id == file_id)
     if task_id is not None:
+        validate_task_id(task_id)
         query = query.filter(ProcessingLog.task_id == task_id)
 
     # Order by timestamp descending and limit
@@ -132,6 +134,7 @@ def get_task_processing_logs(request: Request, task_id: str, db: DbSession):
     Get all processing logs for a specific task.
     Returns logs ordered by timestamp (oldest first to show processing flow).
     """
+    validate_task_id(task_id)
     # Get all logs for this task
     logs = db.query(ProcessingLog).filter(ProcessingLog.task_id == task_id).order_by(ProcessingLog.timestamp).all()
 

app/api/settings.py

@@ -11,6 +11,7 @@ from sqlalchemy.orm import Session
 
 from app.config import settings
 from app.database import get_db
+from app.utils.input_validation import validate_setting_key
 from app.utils.settings_service import (
     SETTING_METADATA,
     delete_setting_from_db,
@@ -98,6 +99,7 @@ async def get_setting(key: str, request: Request, db: DbSession, admin: AdminUse
     Get a specific setting by key.
     Admin only.
     """
+    validate_setting_key(key)
     try:
         # Get current value
         value = getattr(settings, key, None)
@@ -125,6 +127,7 @@ async def update_setting(
     Update a specific setting.
     Admin only.
     """
+    validate_setting_key(key)
     try:
         # Validate the setting value
         if setting.value is not None:
@@ -165,6 +168,7 @@ async def delete_setting(key: str, request: Request, db: DbSession, admin: Admin
     Delete a setting from the database (reverts to environment variable or default).
     Admin only.
     """
+    validate_setting_key(key)
     try:
         success = delete_setting_from_db(db, key)
         if not success: