security: validate billing address structure in Order model #12

New issue

Open

opened 2026-02-20 11:09:26 +00:00 by Clotho · 0 comments

Clotho commented

2026-02-20 11:09:26 +00:00

Member

Issue

Per TODO.md (P1 line 33), Order::create() accepts billing_address array without validating structure. Malformed addresses could cause PDF generation issues or tax calculation failures.

Current Behavior

The billing_address JSON column accepts any array structure without validation:

Order::create([
    "billing_address" => $request->input("billing_address"), // No validation
    // ...
]);

Risk

PDF generation failures: Missing fields like line1, city, postcode could break invoice PDF rendering
Tax calculation errors: TaxService may expect specific country/region fields
Data integrity: Inconsistent address format across orders

Required Fix

Add validation for billing_address structure:

$validated = $request->validate([
    "billing_address" => "required|array",
    "billing_address.line1" => "required|string|max:255",
    "billing_address.line2" => "nullable|string|max:255",
    "billing_address.city" => "required|string|max:100",
    "billing_address.region" => "nullable|string|max:100",
    "billing_address.postcode" => "required|string|max:20",
    "billing_address.country" => "required|string|size:2", // ISO 3166-1 alpha-2
]);

Files to Update

Models/Order.php - Add $casts with validation or custom setter
Services/CommerceService.php - Validate in createOrder() method
Controllers/Api/CommerceController.php - Add validation rules

Priority

P1 - Critical: Required before production launch to prevent runtime errors.

Created by discovery scan (issue #2) - References TODO.md P1

## Issue Per TODO.md (P1 line 33), `Order::create()` accepts `billing_address` array without validating structure. Malformed addresses could cause PDF generation issues or tax calculation failures. ## Current Behavior The `billing_address` JSON column accepts any array structure without validation: ```php Order::create([ "billing_address" => $request->input("billing_address"), // No validation // ... ]); ``` ## Risk - **PDF generation failures:** Missing fields like `line1`, `city`, `postcode` could break invoice PDF rendering - **Tax calculation errors:** `TaxService` may expect specific country/region fields - **Data integrity:** Inconsistent address format across orders ## Required Fix Add validation for billing_address structure: ```php $validated = $request->validate([ "billing_address" => "required|array", "billing_address.line1" => "required|string|max:255", "billing_address.line2" => "nullable|string|max:255", "billing_address.city" => "required|string|max:100", "billing_address.region" => "nullable|string|max:100", "billing_address.postcode" => "required|string|max:20", "billing_address.country" => "required|string|size:2", // ISO 3166-1 alpha-2 ]); ``` ## Files to Update - `Models/Order.php` - Add `$casts` with validation or custom setter - `Services/CommerceService.php` - Validate in `createOrder()` method - `Controllers/Api/CommerceController.php` - Add validation rules ## Priority **P1 - Critical:** Required before production launch to prevent runtime errors. --- _Created by discovery scan (issue #2) - References TODO.md P1_