🔒 Sanitizing inputs

classquiz/routers/quiz.py

@@ -7,6 +7,7 @@ from classquiz.helpers import get_meili_data
 from fastapi import APIRouter, Depends, HTTPException
 from fastapi.responses import JSONResponse
 from pydantic import ValidationError
+import bleach
 
 from classquiz.auth import get_current_user
 from classquiz.config import redis, settings, storage, meilisearch
@@ -22,6 +23,8 @@ router = APIRouter()
 async def create_quiz_lol(quiz_input: QuizInput, user: User = Depends(get_current_user)):
     imgur_regex = r"^https://i\.imgur\.com\/.{7}.(jpg|png|gif)$"
     server_regex = rf"^{settings.root_address}/api/v1/storage/download/.{36}--.{36}$"
+    quiz_input.title = bleach.clean(quiz_input.title, tags=[], strip=True)
+    quiz_input.description = bleach.clean(quiz_input.description, tags=[], strip=True)
     for question in quiz_input.questions:
         if question.image == "":
             question.image = None
@@ -127,6 +130,8 @@ async def update_quiz(quiz_id: str, quiz_input: QuizInput, user: User = Depends(
     else:
         # print(quiz_input)
         # print(quiz)
+        quiz_input.description = bleach.clean(quiz_input.description, tags=[], strip=True)
+        quiz_input.title = bleach.clean(quiz_input.title, tags=[], strip=True)
         meilisearch.index(settings.meilisearch_index).update_documents([await get_meili_data(quiz)])
         if quiz.public and not quiz_input.public:
             print("removing from meilisearch")

classquiz/routers/users.py

@@ -17,6 +17,7 @@ from classquiz.auth import (
 from classquiz.cache import clear_cache_for_account
 from classquiz.config import redis, settings
 import uuid
+import bleach
 from pydantic import BaseModel
 from classquiz.db.models import User, UserSession, UpdatePassword, Token
 from classquiz.emails import send_register_email, send_forgotten_password_email
@@ -58,6 +59,7 @@ async def create_user(user: route_user, background_task: BackgroundTasks) -> Use
         raise HTTPException(status_code=409, detail="User already exists")
 
     user.password = get_password_hash(user.password)
+    user.username = bleach.clean(user.username, tags=[], strip=True)
     if len(user.username) == 32:
         return JSONResponse({"details": "Username mustn't be 32 characters long"}, 400)
     await user.save()