Skip to content

Registration accepts unvalidated stellar_address and lacks structured input validation #16

Description

@abayomicornelius

src/models/user.rs::CreateUserRequest has an optional stellar_address: Option<String> field that is inserted directly into the users table in src/routes/auth.rs::register with zero format checking, unlike src/routes/accounts.rs::validate_stellar_address which does check length/prefix/alphanumeric for the accounts endpoints.

A malformed address stored at registration will silently break any later feature that assumes users.stellar_address is valid. Additionally, CreateUserRequest/LoginRequest don't use the validator crate already listed in Cargo.toml — validation is ad-hoc and duplicated. Reuse validate_stellar_address (or a shared version of it) in register, and consider adopting #[derive(Validate)] consistently.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingsecuritySecurity concern

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions