🔒 Add Input Validation and Sanitization

[Mosas2000]

Description

User inputs are not properly validated before being sent to contracts, which could lead to failed transactions or unexpected behavior.

Current Issues

1. Market Question Input

// useContract.ts - No validation
stringAsciiCV(question)  // What if question contains non-ASCII?

2. Amount Inputs

// TradePage.tsx - Minimal validation
const amount = parseFloat(stakeAmount);
if (isNaN(amount) || amount < MIN_STAKE || amount > MAX_STAKE) return;
// No protection against negative, decimal precision issues

3. Address Inputs

// useContract.ts - No address validation
principalCV(recipient)  // Invalid address will throw cryptic error

Required Validations

Market Question

• Max length: 256 characters (contract limit)
• ASCII only (contract requirement)
• No empty strings
• Trim whitespace

STX/OXC Amounts

• Positive numbers only
• Max precision: 6 decimals
• Within balance limits
• Reasonable maximum (prevent fat-finger errors)

Principal Addresses

• Valid Stacks address format
• Correct network prefix (SP for mainnet, ST for testnet)
• Checksum validation

Duration/Block Heights

• Positive integers
• Reasonable ranges

Proposed Implementation

// utils/validation.ts
export function validateQuestion(q: string): ValidationResult {
  if (q.length > 256) return { valid: false, error: 'Question too long (max 256)' };
  return { valid: true };
}

export function validateAmount(amount: string, balance: number): ValidationResult {
  const num = parseFloat(amount);
  if (isNaN(num)) return { valid: false, error: 'Invalid number' };
  if (num <= 0) return { valid: false, error: 'Amount must be positive' };
  if (num > balance) return { valid: false, error: 'Insufficient balance' };
  return { valid: true };
}

export function validateStacksAddress(addr: string, network: 'mainnet' | 'testnet'): ValidationResult {
  const prefix = network === 'mainnet' ? 'SP' : 'ST';
  // Add checksum validation
  return { valid: true };
}

Files to Create/Modify

• frontend/src/utils/validation.ts (new)
• frontend/src/hooks/useContract.ts (add validation)
• frontend/src/pages/TradePage.tsx (add validation)
• frontend/src/components/MarketForm.tsx (add validation)

Priority

🟠 High - Security and UX improvement

[Mosas2000]

Implemented input validation and sanitization with 11 commits in feature/input-validation branch:

Changes:

1. Created validation utility module with core validators
2. Added amount validation to StakingPage with real-time feedback
3. Added input validation to TradePage for market ID and stake amounts
4. Added market ID validation to PortfolioPage claim winnings
5. Added proposal ID validation to GovernancePage vote handler
6. Added HTML sanitization function for XSS prevention
7. Added URL validation to prevent open redirect vulnerabilities
8. Added comprehensive unit tests for validation utilities
9. Added input validation to useStake hook for market ID and amount
10. Added BigInt validation and safe conversion to useStakingActions hook
11. Fixed TypeScript errors and properly use validation results in UI

Features:

• validateAmount() - Validates stake/trade amounts with min/max bounds
• validateStacksAddress() - Validates Stacks wallet addresses (SP/ST prefix)
• validateMarketQuestion() - Validates market questions for creation
• validateMemo() - Validates memo strings for transfers
• validateMarketId() - Validates market IDs
• validateUrl() - Validates URLs with domain whitelist support
• sanitizeInput() - Sanitizes user inputs
• sanitizeHtml() - Escapes HTML entities for XSS prevention

Build verified successfully.