fix: validate invitation token format before database lookup in web routes #43

New issue

Open

opened 2026-02-20 16:44:04 +00:00 by Clotho · 0 comments

Clotho commented

2026-02-20 16:44:04 +00:00

Member

Problem

Routes/web.php (line ~44) passes the invitation token directly to WorkspaceInvitation::findPendingByToken() without validating its format first. Tokens should be exactly 64 alphanumeric characters.

Impact

Malformed tokens (e.g. path traversal attempts, very long strings) reach the database and service layer
No early rejection of obviously invalid inputs
Combined with the O(n) lookup issue (#9), a malformed token still triggers loading all pending invitations

Acceptance Criteria

Add format validation before the token lookup: preg_match('/^[a-zA-Z0-9]{64}$/', $token)
Return 404 immediately for tokens that do not match the expected format
Add test for malformed token rejection

Discovered during automated scan (issue #3)

## Problem `Routes/web.php` (line ~44) passes the invitation token directly to `WorkspaceInvitation::findPendingByToken()` without validating its format first. Tokens should be exactly 64 alphanumeric characters. ## Impact - Malformed tokens (e.g. path traversal attempts, very long strings) reach the database and service layer - No early rejection of obviously invalid inputs - Combined with the O(n) lookup issue (#9), a malformed token still triggers loading all pending invitations ## Acceptance Criteria - Add format validation before the token lookup: `preg_match('/^[a-zA-Z0-9]{64}$/', $token)` - Return 404 immediately for tokens that do not match the expected format - Add test for malformed token rejection _Discovered during automated scan (issue #3)_