security: validate template variable injection #5

New issue

Open

opened 2026-02-20 03:01:52 +00:00 by Clotho · 0 comments

Clotho commented

2026-02-20 03:01:52 +00:00

Member

Issue

Location: Services/PlanTemplateService.php::substituteVariables()
Risk: Special characters in variables could corrupt JSON structure

Current Behavior

Template variable substitution uses escapeForJson but lacks comprehensive input sanitisation. Malicious variable values could potentially inject template syntax.

Expected Behavior

Variable values should be validated against allowed character sets before substitution.

Acceptance Criteria

Validate variable values against allowed character sets
Reject malicious variable values with clear error message
Add tests for injection attempts
Document allowed character set

References

TODO.md: VAL-001
Related: ContentService.php:218-222 has similar string replacement

## Issue **Location:** `Services/PlanTemplateService.php::substituteVariables()` **Risk:** Special characters in variables could corrupt JSON structure ## Current Behavior Template variable substitution uses `escapeForJson` but lacks comprehensive input sanitisation. Malicious variable values could potentially inject template syntax. ## Expected Behavior Variable values should be validated against allowed character sets before substitution. ## Acceptance Criteria - [ ] Validate variable values against allowed character sets - [ ] Reject malicious variable values with clear error message - [ ] Add tests for injection attempts - [ ] Document allowed character set ## References - TODO.md: VAL-001 - Related: `ContentService.php:218-222` has similar string replacement