Input Validation¶

# From backend/api/schemas/camera.py:114-121
name: str = Field(..., min_length=1, max_length=255, description="Camera name")
folder_path: str = Field(
    ..., min_length=1, max_length=500, description="File system path for camera uploads"
)
status: CameraStatus = Field(
    default=CameraStatus.ONLINE,
    description="Camera status (online, offline, error, unknown)",
)

# From backend/api/schemas/camera.py:123-136
@field_validator("name")
@classmethod
def validate_name(cls, v: str) -> str:
    """Validate and sanitize camera name.

    NEM-2569: Rejects control characters, strips whitespace.
    """
    return _validate_camera_name(v)

@field_validator("folder_path")
@classmethod
def validate_folder_path(cls, v: str) -> str:
    """Validate folder_path for security."""
    return _validate_folder_path(v)

# From backend/api/schemas/camera.py:36-63
def _validate_folder_path(v: str) -> str:
    """Validate folder_path for security and correctness."""
    # Check for path traversal attempts
    if ".." in v:
        raise ValueError("Path traversal (..) not allowed in folder_path")

    # Check path length
    if not v or len(v) > 500:
        raise ValueError("folder_path must be between 1 and 500 characters")

    # Check for forbidden characters
    if _FORBIDDEN_PATH_CHARS.search(v):
        raise ValueError(
            'folder_path contains forbidden characters (< > : " | ? * or control characters)'
        )

    return v

# From backend/api/schemas/camera.py:27-33
# Regex pattern for forbidden path characters
_FORBIDDEN_PATH_CHARS = re.compile(r'[<>:"|?*\x00-\x1f]')

# Regex pattern for forbidden name characters
_FORBIDDEN_NAME_CHARS = re.compile(r"[\x00-\x1f\x7f]")

# From backend/api/schemas/camera.py:66-93
def _validate_camera_name(v: str) -> str:
    """Validate and sanitize camera name."""
    # Strip leading/trailing whitespace
    stripped = v.strip()

    # Check if name is effectively empty after stripping
    if not stripped:
        raise ValueError("Camera name cannot be empty or whitespace-only")

    # Check for forbidden control characters
    if _FORBIDDEN_NAME_CHARS.search(v):
        raise ValueError(
            "Camera name contains forbidden characters (control characters)"
        )

    return stripped

# From backend/api/schemas/zone.py:115-156
def _validate_polygon_geometry(coords: list[list[float]]) -> list[list[float]]:
    """Validate that coordinates form a valid polygon.

    Checks:
    1. Each point has exactly 2 values [x, y]
    2. All values are normalized (0-1 range)
    3. No duplicate consecutive points
    4. Polygon has positive area (not degenerate)
    5. Polygon does not self-intersect
    """
    # Check point format and normalization
    for point in coords:
        if len(point) != 2:
            raise ValueError("Each coordinate must have exactly 2 values [x, y]")
        x, y = point
        if not (0 <= x <= 1 and 0 <= y <= 1):
            raise ValueError("Coordinates must be normalized (0-1 range)")

    # Check for duplicate consecutive points
    if _has_duplicate_consecutive_points(coords):
        raise ValueError("Polygon has duplicate consecutive points")

    # Check polygon has positive area
    area = abs(_polygon_area(coords))
    if area < 1e-10:
        raise ValueError("Polygon has zero or near-zero area")

    # Check for self-intersection
    if _is_self_intersecting(coords):
        raise ValueError("Polygon edges must not intersect")

    return coords

# Safe - SQLAlchemy handles parameterization
result = await session.execute(
    select(Camera).where(Camera.id == camera_id)
)

# Safe - all values are parameterized
result = await session.execute(
    select(Detection).where(
        Detection.camera_id == camera_id,
        Detection.detected_at >= start_date
    )
)

# From backend/core/database.py
async def get_db() -> AsyncGenerator[AsyncSession, None]:
    """Get database session as FastAPI dependency."""
    async with get_session() as session:
        yield session

# From backend/main.py:1059-1061
# Add body size limit middleware to prevent DoS attacks (NEM-1614)
# Default: 10MB limit for request bodies
app.add_middleware(BodySizeLimitMiddleware, max_body_size=10 * 1024 * 1024)

# From backend/main.py:1005-1007
# Add Content-Type validation middleware for request body validation (NEM-1617)
# Validates that POST/PUT/PATCH requests have acceptable Content-Type headers
app.add_middleware(ContentTypeValidationMiddleware)

# From backend/core/sanitization.py:103-130
def sanitize_path_for_error(path: str) -> str:
    """Sanitize a file path for safe inclusion in error messages.

    Removes the directory path and returns only the filename to prevent
    information disclosure about internal file system structure.
    """
    if not path:
        return "[unknown]"

    # Extract just the filename
    parts = path.replace("\\", "/").rsplit("/", 1)
    filename = parts[1] if len(parts) == 2 else parts[0]

    # Limit length to prevent very long filenames in logs
    if len(filename) > 100:
        filename = filename[:97] + "..."

    return filename

# From backend/core/sanitization.py:159-169
# Pattern matches: protocol://user:pass@host  # pragma: allowlist secret
url_credentials_pattern = re.compile(
    r"([a-zA-Z][a-zA-Z0-9+.-]*://)?([^:@\s/]+):([^@\s/]+)@([^\s]+)", re.IGNORECASE  # pragma: allowlist secret
)

def replace_url_credentials(match: re.Match[str]) -> str:
    protocol = match.group(1) or ""
    host_and_rest = match.group(4)
    return f"{protocol}[CREDENTIALS_REDACTED]@{host_and_rest}"

# From backend/core/sanitization.py:359-433
def sanitize_metric_label(
    value: str,
    label_name: str = "",
    allowlist: frozenset[str] | None = None,
    max_length: int = METRIC_LABEL_MAX_LENGTH,
) -> str:
    """Sanitize a value for use as a Prometheus metric label.

    Prevents cardinality explosion by:
    1. Limiting length
    2. Normalizing to lowercase
    3. Replacing special characters
    4. Using allowlist when available
    """

{
  "detail": [
    {
      "type": "string_too_short",
      "loc": ["body", "name"],
      "msg": "String should have at least 1 character",
      "input": "",
      "ctx": { "min_length": 1 }
    }
  ]
}