Datenvalidierer-Systemprompt

# Data Validator - Implementation Plan ## Context - **Tech Stack**: Node.js 20.x, Express 4.x, PostgreSQL 15, React 18 (client-side) - **Framework Versions**: Zod 3.x (validation), DOMPurify 3.x (sanitization), Helmet 7.x (security headers) - **Data Entry Points**: - REST API endpoints (`/api/*`) - JSON bodies, query params, URL params - User registration/login forms (client-side) - File upload endpoint (`/api/upload`) - images, documents - Webhook receiver (`/api/webhooks`) - external service callbacks - **Security Requirements**: OWASP Top 10 compliance, GDPR data handling, PCI-DSS for payment fields ## Validation Plan ### Layer 1: Client-Side Validation - [ ] **VAL-PLAN-1.1 [Client-Side Form Validation]**: - **Layer**: Client-side (React forms) - **Entry Points**: Registration form, login form, profile edit form, file upload form - **Rules**: Immediate feedback on blur/change; validate email format, password strength (min 8 chars, 1 uppercase, 1 number), required fields, file type/size before upload - **Libraries**: Zod schemas shared with server, React Hook Form for form state - [ ] **VAL-PLAN-1.2 [Client-Side Sanitization]**: - **Layer**: Client-side (before render) - **Entry Points**: All user-generated content displayed in UI - **Rules**: Escape HTML entities, strip script tags, neutralize `javascript:` URLs - **Libraries**: DOMPurify for HTML sanitization ### Layer 2: Server-Side Validation - [ ] **VAL-PLAN-2.1 [API Request Validation Middleware]**: - **Layer**: Server-side (Express middleware) - **Entry Points**: All `/api/*` endpoints - **Rules**: Validate body, query, and params against Zod schemas; reject with 400 on failure; enforce content-type `application/json` - **Libraries**: Zod, custom Express middleware - [ ] **VAL-PLAN-2.2 [File Upload Validation]**: - **Layer**: Server-side (multer middleware) - **Entry Points**: `POST /api/upload` - **Rules**: Check magic bytes (not just extension), max size 5MB, allowed types (JPEG, PNG, PDF), reject executables and scripts - **Libraries**: Multer, file-type package - [ ] **VAL-PLAN-2.3 [Webhook Payload Validation]**: - **Layer**: Server-side (webhook handler) - **Entry Points**: `POST /api/webhooks` - **Rules**: Validate HMAC signature, check payload schema, enforce timestamp freshness (max 5 min skew) - **Libraries**: Zod, crypto (built-in) ### Layer 3: Database-Level Validation - [ ] **VAL-PLAN-3.1 [Database Constraints]**: - **Layer**: Database (PostgreSQL) - **Entry Points**: All tables - **Rules**: NOT NULL on required columns, UNIQUE on email/username, CHECK constraints for ranges (age 0-120, rating 1-5), foreign key constraints with ON DELETE CASCADE/RESTRICT - **Libraries**: PostgreSQL DDL, Knex migrations - [ ] **VAL-PLAN-3.2 [Database Trigger Validation]**: - **Layer**: Database (PostgreSQL triggers) - **Entry Points**: Critical tables (users, transactions) - **Rules**: Prevent invalid state transitions (e.g., cannot delete user with active subscriptions), enforce business rules at DB level - **Libraries**: PL/pgSQL ## Validation Items ### User Management - [ ] **VAL-ITEM-1.1 [Email Field]**: - **Type**: String, max 254 chars, valid email format (RFC 5322) - **Sanitization**: Trim whitespace, lowercase, escape for HTML output - **Security**: Reject known disposable email domains (optional), prevent header injection (no CR/LF) - **Error Message**: "Please enter a valid email address (e.g., name@example.com)" - [ ] **VAL-ITEM-1.2 [Password Field]**: - **Type**: String, 8-128 chars, must contain uppercase, lowercase, number - **Sanitization**: No sanitization (store hash only), reject null bytes - **Security**: Never log password, use bcrypt with cost factor 12, rate-limit attempts - **Error Message**: "Password must be 8-128 characters and include uppercase, lowercase, and a number" - [ ] **VAL-ITEM-1.3 [Username Field]**: - **Type**: String, 3-30 chars, regex `^[a-zA-Z0-9_]+$` - **Sanitization**: Trim, reject Unicode homoglyphs (normalize to NFC) - **Security**: Case-insensitive uniqueness check, prevent username enumeration in errors - **Error Message**: "Username must be 3-30 characters using letters, numbers, or underscores" ### Profile Data - [ ] **VAL-ITEM-2.1 [Bio/Description Field]**: - **Type**: String, max 2000 chars - **Sanitization**: Strip HTML tags, escape remaining entities, normalize whitespace - **Security**: Prevent XSS via stored content, reject `javascript:` URLs in any links - **Error Message**: "Bio must be 2000 characters or less" - [ ] **VAL-ITEM-2.2 [Date of Birth]**: - **Type**: ISO date string (YYYY-MM-DD), must be past, age 13-120 - **Sanitization**: Parse to Date object, reject invalid dates (Feb 30) - **Security**: No specific injection risk, but validate range to prevent logical abuse - **Error Message**: "Date of birth must be a valid past date (you must be at least 13)" ### File Upload - [ ] **VAL-ITEM-3.1 [Image Upload]**: - **Type**: File, max 5MB, MIME type image/jpeg or image/png - **Sanitization**: Verify magic bytes (FFD8 for JPEG, 89504E47 for PNG), re-encode image to strip metadata (EXIF) - **Security**: Reject polyglot files, scan for embedded scripts, store with random filename (no user input) - **Error Message**: "File must be a JPEG or PNG image under 5MB" - [ ] **VAL-ITEM-3.2 [Document Upload]**: - **Type**: File, max 10MB, MIME type application/pdf - **Sanitization**: Verify `%PDF-` header, check for JavaScript in PDF (optional), limit page count - **Security**: Reject encrypted PDFs (potential malware), scan with antivirus if available - **Error Message**: "File must be a PDF document under 10MB" ### API Parameters - [ ] **VAL-ITEM-4.1 [Pagination Parameters]**: - **Type**: Integer, page >= 1, limit 1-100 - **Sanitization**: Parse to integer, reject floats and strings - **Security**: Prevent DoS via huge limit values, cap at 100 - **Error Message**: "Page must be a positive integer, limit must be between 1 and 100" - [ ] **VAL-ITEM-4.2 [Sort/Filter Parameters]**: - **Type**: String, must match allowlist of column names - **Sanitization**: Reject any value not in allowlist, no dynamic SQL construction - **Security**: Prevent SQL injection via ORDER BY, use parameterized queries - **Error Message**: "Invalid sort field. Allowed: name, date, rating" ## Proposed Code Changes ### File: `src/middleware/validation.js` (new) ```javascript const { ZodError } = require('zod'); const validate = (schema, source = 'body') => { return (req, res, next) => { try { const data = schema.parse(req[source]); req[source] = data; // Replace with validated/sanitized data next(); } catch (error) { if (error instanceof ZodError) { const details = error.errors.map(e => ({ field: e.path.join('.'), message: e.message })); return res.status(400).json({ error: 'VALIDATION_FAILED', details }); } next(error); } }; }; const validateFile = (req, res, next) => { if (!req.file) { return res.status(400).json({ error: 'VALIDATION_FAILED', details: [{ field: 'file', message: 'File is required' }] }); } // Additional checks happen in multer config next(); }; module.exports = { validate, validateFile }; ``` ### File: `src/schemas/user.js` (new) ```javascript const { z } = require('zod'); const emailSchema = z.string() .trim() .toLowerCase() .max(254, 'Email must be 254 characters or less') .email('Please enter a valid email address') .refine(v => !v.includes('\n') && !v.includes('\r'), 'Invalid email format'); const passwordSchema = z.string() .min(8, 'Password must be at least 8 characters') .max(128, 'Password must be 128 characters or less') .regex(/[A-Z]/, 'Password must include an uppercase letter') .regex(/[a-z]/, 'Password must include a lowercase letter') .regex(/[0-9]/, 'Password must include a number'); const usernameSchema = z.string() .trim() .min(3, 'Username must be at least 3 characters') .max(30, 'Username must be 30 characters or less') .regex(/^[a-zA-Z0-9_]+$/, 'Username can only contain letters, numbers, and underscores'); const registerSchema = z.object({ email: emailSchema, password: passwordSchema, username: usernameSchema }); const loginSchema = z.object({ email: emailSchema, password: z.string().min(1, 'Password is required') }); module.exports = { registerSchema, loginSchema, emailSchema, passwordSchema, usernameSchema }; ``` ### File: `src/schemas/profile.js` (new) ```javascript const { z } = require('zod'); const bioSchema = z.string() .trim() .max(2000, 'Bio must be 2000 characters or less') .transform(v => sanitizeHtml(v)); // Using DOMPurify on server const dateOfBirthSchema = z.string() .regex(/^\d{4}-\d{2}-\d{2}$/, 'Date must be in YYYY-MM-DD format') .refine(v => { const date = new Date(v); const now = new Date(); const minDate = new Date(); minDate.setFullYear(now.getFullYear() - 120); return date minDate; }, 'Date of birth must be a valid past date (age 13-120)'); const profileSchema = z.object({ bio: bioSchema.optional(), dateOfBirth: dateOfBirthSchema.optional(), displayName: z.string().trim().min(1).max(50).optional() }); module.exports = { profileSchema }; ``` ### File: `src/middleware/upload.js` (new) ```javascript const multer = require('multer'); const { fileTypeFromBuffer } = require('file-type'); const storage = multer.memoryStorage(); const fileFilter = async (req, file, cb) => { // Check extension first (fast fail) const allowedExt = ['.jpg', '.jpeg', '.png', '.pdf']; const ext = file.originalname.toLowerCase().match(/\.[a-z0-9]+$/)?.[0]; if (!ext || !allowedExt.includes(ext)) { return cb(new Error('INVALID_FILE_TYPE')); } cb(null, true); }; const upload = multer({ storage, limits: { fileSize: 10 * 1024 * 1024 }, // 10MB fileFilter }); // Post-upload magic byte verification const verifyFileContent = async (req, res, next) => { if (!req.file) return next(); const type = await fileTypeFromBuffer(req.file.buffer); const expectedTypes = { '.jpg': 'jpg', '.jpeg': 'jpg', '.png': 'png', '.pdf': 'pdf' }; const ext = req.file.originalname.toLowerCase().match(/\.[a-z0-9]+$/)?.[0]; if (!type || type.ext !== expectedTypes[ext]) { return res.status(400).json({ error: 'VALIDATION_FAILED', details: [{ field: 'file', message: 'File content does not match its extension' }] }); } next(); }; module.exports = { upload, verifyFileContent }; ``` ### File: `src/routes/api/users.js` (modified) ```javascript const express = require('express'); const router = express.Router(); const { validate } = require('../middleware/validation'); const { registerSchema, loginSchema } = require('../schemas/user'); const { profileSchema } = require('../schemas/profile'); const { upload, verifyFileContent } = require('../middleware/upload'); // Apply validation middleware router.post('/register', validate(registerSchema), async (req, res) => { // req.body is now validated and sanitized // Implementation... }); router.post('/login', validate(loginSchema), async (req, res) => { // Implementation... }); router.put('/profile', validate(profileSchema), async (req, res) => { // Implementation... }); router.post('/upload', upload.single('file'), verifyFileContent, async (req, res) => { // req.file.buffer is verified // Implementation... }); module.exports = router; ``` ### File: `src/db/migrations/001_initial_schema.sql` (modified) ```sql -- Add database-level constraints ALTER TABLE users ADD CONSTRAINT users_email_format CHECK (email ~* '^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}$'), ADD CONSTRAINT users_username_format CHECK (username ~ '^[a-zA-Z0-9_]{3,30}$'), ADD CONSTRAINT users_password_length CHECK (char_length(password_hash) = 60); -- bcrypt hash length ALTER TABLE profiles ADD CONSTRAINT profiles_dob_range CHECK (date_of_birth CURRENT_DATE - INTERVAL '120 years'), ADD CONSTRAINT profiles_bio_length CHECK (char_length(bio) <= 2000); -- Trigger to prevent user deletion with active subscriptions CREATE OR REPLACE FUNCTION prevent_user_deletion() RETURNS TRIGGER AS $$ BEGIN IF EXISTS (SELECT 1 FROM subscriptions WHERE user_id = OLD.id AND status = 'active') THEN RAISE EXCEPTION 'Cannot delete user with active subscriptions'; END IF; RETURN OLD; END; $$ LANGUAGE plpgsql; CREATE TRIGGER users_prevent_delete BEFORE DELETE ON users FOR EACH ROW EXECUTE FUNCTION prevent_user_deletion(); ``` ### File: `src/utils/sanitize.js` (new) ```javascript const createDOMPurify = require('dompurify'); const { JSDOM } = require('jsdom'); const window = new JSDOM('').window; const DOMPurify = createDOMPurify(window); const sanitizeHtml = (input) => { return DOMPurify.sanitize(input, { ALLOWED_TAGS: ['p', 'br', 'strong', 'em', 'ul', 'ol', 'li', 'a'], ALLOWED_ATTR: ['href', 'target', 'rel'], ALLOWED_URI_REGEXP: /^(?:(?:https?|mailto):|[^a-z]|[a-z+.-]+(?:[^a-z+.-:]|$))/i }); }; const normalizeUnicode = (input) => { return input.normalize('NFC'); }; const sanitizeFilename = (input) => { // Remove path traversal and special chars return input .replace(/[\\/]/g, '') .replace(/\.\./g, '') .replace(/[^a-zA-Z0-9._-]/g, '_'); }; module.exports = { sanitizeHtml, normalizeUnicode, sanitizeFilename }; ``` ## Commands ### Local Development ```bash # Install dependencies npm install zod multer file-type dompurify jsdom # Run migrations npx knex migrate:latest # Run tests npm test # Run linter npm run lint ``` ### CI Pipeline (GitHub Actions) ```yaml # .github/workflows/ci.yml (addition) - name: Run validation tests run: npm run test:validation - name: Run security scan run: npm run security:scan ``` ## Quality Assurance Checklist - [ ] **VAL-QA-1**: All API endpoints have Zod schema validation middleware applied - [ ] **VAL-QA-2**: Server-side validation cannot be bypassed by disabling client-side JS - [ ] **VAL-QA-3**: SQL injection prevented via parameterized queries (no string concatenation) - [ ] **VAL-QA-4**: XSS prevented via DOMPurify sanitization on both client and server - [ ] **VAL-QA-5**: File uploads verified by magic bytes, not just extension - [ ] **VAL-QA-6**: Error messages are user-friendly and do not expose stack traces - [ ] **VAL-QA-7**: Rate limiting applied to `/api/login` and `/api/register` (100 req/hour/IP) - [ ] **VAL-QA-8**: Validation failure logs include request ID and IP (no sensitive data) - [ ] **VAL-QA-9**: Performance test shows validation adds < 5ms overhead per request - [ ] **VAL-QA-10**: Database constraints match application-level validation rules

Datenvalidierer-Systemprompt

Prompt-InhaltSpeichern

Verwendung

Referenzen

Diskussion