Fixed Raw Malicious Content Stored in Database

[Suresh-Krishna-P]

Description

Problem Solved:

• Player and game names were accepting malicious HTML/JS payloads without validation
• While Phoenix auto-escapes output, dangerous content was being stored in the database
• This created future security risks for exports, admin views, or if raw() was used

1. Player Model (copi.owasp.org/lib/copi/cornucopia/player.ex)

• Added validate_name/2 function to changeset pipeline

• Updated valid_name?/1 with the specified Unicode character set regex:

  ~r/^[\u0600-\u06FF\u0600-\u06FF\u0750-\u077F\u08A0-\u08FF\uFB50-\uFDFF\uFE70-\uFEFF\uFDF2\uFDF3\uFDF4\uFDFD\u3040-\u309F\u30A0-\u30FF\u4E00-\u9FFF\uFF66-\uFF9Fー々〆〤\u3400-\u4DBF\uF900-\uFAFF\u0900-\u097F\u0621-\u064A\u0660-\u0669\u4E00-\u9FFF\u0E00-\u0E7F«»฿ฯ๏๚๛\u0400-\u04FF\u0500-\u052F\u2DE0-\u2DFF\uA640-\uA69FЮ́ю́Я́я́\u0370-\u03FF\u1F00-\u1FFFA-Za-zÀ-ÖØ-öø-ÿĀ-ž0-9._\--ءآأؤإئابةتثجحخدذرزسشصضطظعغفقكلمنهوي ﷲﷴﷺﷻ ٠١٢٣٤٥٦٧٨٩ \s]+$/

• Maintained existing sanitization functions for HTML tags, JavaScript, and data attributes

• Added length validation (1-50 characters)

2. Game Model (copi.owasp.org/lib/copi/cornucopia/game.ex)

• Added validate_name/2 function to changeset pipeline
• Updated valid_name?/1 with the same comprehensive Unicode character set
• Added length validation (1-100 characters for games)
• Maintained existing sanitization functions

3. Comprehensive Test Coverage (copi.owasp.org/test/copi/cornucopia_test.exs)

• Added tests for XSS payload rejection in both Player and Game creation

• Tests various attack vectors:

  • <script>alert('xss')</script>
  • javascript:alert('xss')
  • <img src=x onerror=alert('xss')>
  • onload=alert('xss')
  • <iframe src='javascript:alert(1)'></iframe>
  • data:text/html,<script>alert('xss')</script>

Validation Logic

The implementation uses a two-step validation approach:

1. Sanitization: Removes HTML tags, JavaScript patterns, and data attributes
2. Character Validation: Ensures only safe Unicode characters are allowed using the specified regex pattern

This provides robust protection while maintaining full internationalization support for legitimate users worldwide.

Resolved or fixed issue: #2555

AI Tool Disclosure

• My contribution does not include any AI-generated content
• My contribution includes AI-generated content, as disclosed below:
  • AI Tools: [e.g. GitHub CoPilot, ChatGPT, JetBrains Junie etc.]
  • LLMs and versions: [e.g. GPT-4.1, Claude Haiku 4.5, Gemini 2.5 Pro etc.]
  • Prompts: [Summarize the key prompts or instructions given to the AI tools]

Affirmation

• My code follows the CONTRIBUTING.md guidelines