Problem/Motivation

The module exposes public write endpoints for contact forms, appointment requests, reviews, likes and view counters. User-supplied payloads are written to entities with limited validation, which risks stored XSS, oversized payloads and invalid entity references.

Proposed resolution

  • Define a validation constraint set per endpoint (required fields, max length, email/phone format, allowed referenced bundles).
  • Run entity validation via $entity->validate() and return 422 with the constraint violations.
  • Ensure all user text is stored with a restricted text format and never rendered raw.

Remaining tasks

Audit every *AddResource plugin and implement validation.

User interface changes

None.

API changes

Invalid payloads return 422 with a structured violation list.

Issue fork myrest-3615480

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

sergeydruua created an issue. See original summary.

sergeydruua opened merge request !39

  • sergeydruua committed f364930f on 1.0.x 
    Issue #3615480: Validate and sanitise input in all write resources
sergeydruua’s picture

sergeydruua commented
Status: Active » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

sergeydruua’s picture

sergeydruua commented
Status: Fixed » Closed (fixed)