diff options
| author | Paul Buetow <paul@buetow.org> | 2026-05-20 14:08:46 +0300 |
|---|---|---|
| committer | Paul Buetow <paul@buetow.org> | 2026-05-20 14:08:46 +0300 |
| commit | 7e65725253e40dce726d1be441b33b72d72ea8c4 (patch) | |
| tree | b6da59cfb05f03f51ca6b17fb93ba4fc855717d8 /player-android/test | |
| parent | dd3a961436868c32585b201b2da2dd5be23d609c (diff) | |
Escape LIKE wildcards in search and validate password on CreateUser (j9+i9)
- Extract escapeLike helper in repository/media.go to explicitly name and
encapsulate the LIKE wildcard sanitisation (%, _, \) used by ListMedia,
preventing timing-based SQL injection via crafted search terms.
- Add ErrWeakPassword sentinel and minPasswordLen=8 constant; reject blank
or short passwords in userAdminService.CreateUser before hashing.
- Map ErrWeakPassword to HTTP 400 in handleError.
- Update service tests to use an 8-char password and add weak/empty cases.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Diffstat (limited to 'player-android/test')
0 files changed, 0 insertions, 0 deletions