[#34] feat: add input validation for component_id and area_id parameters #39
Conversation
There was a problem hiding this comment.
Pull request overview
This PR adds input validation for component_id and area_id parameters in REST API endpoints to enforce ROS 2 naming conventions and improve security. The implementation introduces a new validate_entity_id() helper function that validates entity IDs against a whitelist of allowed characters (alphanumeric, underscore, forward slash) and rejects invalid input with descriptive 400 Bad Request error responses.
Key Changes:
- Added
validate_entity_id()helper function with character whitelist validation and length limits - Applied validation to both
/areas/{area_id}/componentsand/components/{component_id}/dataendpoints - Removed TODO comment about input validation in
handle_component_data
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 8 comments.
| File | Description |
|---|---|
| src/ros2_medkit_gateway/src/rest_server.cpp | Implements validation function and integrates it into area_components and component_data handlers |
| src/ros2_medkit_gateway/include/ros2_medkit_gateway/rest_server.hpp | Declares validate_entity_id helper method in RESTServer class |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
mfaferek93
force-pushed
the
34/feat/input_validation_for_component_id
branch
from
cb02d3f to
0238d2f
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
mfaferek93
force-pushed
the
34/feat/input_validation_for_component_id
branch
from
0238d2f to
4745f7a
Compare
Add validation to REST API endpoints enforcing ROS 2 naming conventions (alphanumeric, underscore, forward slash). Rejects invalid input with 400 Bad Request and descriptive error messages. Improves security by blocking special characters and preventing injection attempts.
mfaferek93
force-pushed
the
34/feat/input_validation_for_component_id
branch
from
4745f7a to
5866028
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Upgrade to C++23 for std::expected support - Refactor validate_entity_id to return std::expected<void, std::string> - Replace magic numbers with httplib::StatusCode enums
mfaferek93
force-pushed
the
34/feat/input_validation_for_component_id
branch
from
c2f9445 to
1a5f3ba
Compare
…ers (#39) * [#34] feat: add input validation for component_id and area_id parameters Add validation to REST API endpoints enforcing ROS 2 naming conventions (alphanumeric, underscore, forward slash). Rejects invalid input with 400 Bad Request and descriptive error messages. Improves security by blocking special characters and preventing injection attempts. * [#34] fix: use C++23 std::expected and httplib status enums - Upgrade to C++23 for std::expected support - Refactor validate_entity_id to return std::expected<void, std::string> - Replace magic numbers with httplib::StatusCode enums --------- Co-authored-by: Michał Fąferek <michal.faferek@42dot.ai>
2 participants
Pull Request
Summary
Add validation to REST API endpoints enforcing ROS 2 naming conventions
(alphanumeric, underscore, forward slash). Rejects invalid input with
400 Bad Request and descriptive error messages. Improves security by
blocking special characters and preventing injection attempts.
Issue
Link the related issue (required):
Type
Testing
How was this tested / how should reviewers verify it?
Checklist