From 8a6209313052371c123c5996cb41b9e431251874 Mon Sep 17 00:00:00 2001
From: Siddharth Kumar Sah <siddharth123sk@gmail.com>
Date: Sat, 28 Mar 2026 18:54:26 +0800
Subject: [PATCH] fix: reject HTML tags in settings API to prevent stored XSS

PUT /api/v1/settings now returns 400 if any key or value contains HTML
tags. Settings are configuration values - there is no legitimate use
case for HTML in them.
---
 apps/api/src/routes/settings.ts |  9 +++++++++
 tests/integration/api.test.ts   | 36 +++++++++++++++++++++++++++++++++
 2 files changed, 45 insertions(+)

diff --git a/apps/api/src/routes/settings.ts b/apps/api/src/routes/settings.ts
index bb660e5d..1f259730 100644
--- a/apps/api/src/routes/settings.ts
+++ b/apps/api/src/routes/settings.ts
@@ -11,6 +11,8 @@ import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
 import { db, schema } from "../db/index.js";
 import { requireAdmin, requireAuth } from "../plugins/auth.js";
 
+const HTML_TAG_PATTERN = /<[a-z/!][^>]*>/i;
+
 export async function settingsRoutes(app: FastifyInstance): Promise<void> {
   // GET /api/v1/settings — Get all settings as a key-value object
   app.get("/api/v1/settings", async (request: FastifyRequest, reply: FastifyReply) => {
@@ -49,6 +51,13 @@ export async function settingsRoutes(app: FastifyInstance): Promise<void> {
 
       const strValue = typeof value === "string" ? value : JSON.stringify(value);
 
+      if (HTML_TAG_PATTERN.test(key) || HTML_TAG_PATTERN.test(strValue)) {
+        return reply.status(400).send({
+          error: "Settings keys and values must not contain HTML tags",
+          code: "VALIDATION_ERROR",
+        });
+      }
+
       // Upsert: insert or update on conflict
       const existing = db.select().from(schema.settings).where(eq(schema.settings.key, key)).get();
 
diff --git a/tests/integration/api.test.ts b/tests/integration/api.test.ts
index 8f7a533b..7b986ac7 100644
--- a/tests/integration/api.test.ts
+++ b/tests/integration/api.test.ts
@@ -1395,6 +1395,42 @@ describe("Settings", () => {
       });
       expect(JSON.parse(res.body).value).toBe("updated");
     });
+
+    it("rejects HTML tags in setting values", async () => {
+      const res = await app.inject({
+        method: "PUT",
+        url: "/api/v1/settings",
+        headers: { authorization: `Bearer ${adminToken}` },
+        payload: { app_name: "<script>alert('xss')</script>" },
+      });
+      expect(res.statusCode).toBe(400);
+      const body = JSON.parse(res.body);
+      expect(body.code).toBe("VALIDATION_ERROR");
+    });
+
+    it("rejects HTML tags in setting keys", async () => {
+      const res = await app.inject({
+        method: "PUT",
+        url: "/api/v1/settings",
+        headers: { authorization: `Bearer ${adminToken}` },
+        payload: { "<img src=x onerror=alert(1)>": "test" },
+      });
+      expect(res.statusCode).toBe(400);
+      const body = JSON.parse(res.body);
+      expect(body.code).toBe("VALIDATION_ERROR");
+    });
+
+    it("allows normal setting values without HTML", async () => {
+      const res = await app.inject({
+        method: "PUT",
+        url: "/api/v1/settings",
+        headers: { authorization: `Bearer ${adminToken}` },
+        payload: { app_name: "My App (v2.0) - Production" },
+      });
+      expect(res.statusCode).toBe(200);
+      const body = JSON.parse(res.body);
+      expect(body.ok).toBe(true);
+    });
   });
 
   describe("GET /api/v1/settings/:key", () => {