Actions
Bug #66
closedImproper Input Length Validation in /api/diseases/add (API-Web)
Status:
Closed
Priority:
Normal
Assignee:
-
Description
The API does not enforce input length restrictions on the following fields:
name
description
message
Even when values exceed reasonable or expected limits (e.g., 150+ for name, 500+ for description, 200+ for message), the API successfully processes and stores the data.
This indicates missing server-side validation.
Steps to Reproduce
- Send a POST request to:
/api/diseases/add - Provide excessively long inputs:
- name > 150 characters
- description > 500 characters
- message > 200 characters
Actual Result
API accepts and stores the oversized input without validation:
{
"success": true,
"message": "Disease added successfully"
}
**```
Expected Result**
System should validate inputs before processing:
* Reject name values exceeding allowed length (e.g., 150 characters)
* Reject description values exceeding allowed length (e.g., 500 characters)
* Reject message values exceeding allowed length (e.g., 200 characters)
API should return proper validation errors:
{
"success": false,
"message": "Validation error",
"errors": {
"name": "Maximum length exceeded",
"description": "Maximum length exceeded",
"message": "Maximum length exceeded"
}
}
Actions