### Implementing Input Validation and Sanitization for User Inputs To implement input validation and sanitization, we will use Spring Boot's built-in validation features along with Hibernate Validator. This will help ensure that user inputs meet specific criteria before they are processed by the application. #### Step 1: Add Validation Dependencies First, ensure you have the following dependencies in your `pom.xml`: ```xml org.springframework.boot spring-boot-starter-validation ``` #### Step 2: Create Validation Annotations Create a `User` entity with validation annotations: ```java import jakarta.validation.constraints.NotEmpty; import jakarta.validation.constraints.Email; import jakarta.validation.constraints.Size; @Entity public class User { @NotEmpty(message = "Username is required") @Size(min = 3, max = 20, message = "Username must be between 3 and 20 characters") private String username; @NotEmpty(message = "Email is required") @Email(message = "Please provide a valid email address") private String email; @NotEmpty(message = "Password is required") @Size(min = 8, max = 128, message = "Password must be between 8 and 128 characters") private String password; // Getters and Setters } ``` #### Step 3: Implement Validation in Controller Update your controller to use `@Valid` annotation: ```java @PostMapping("/register") public ResponseEntity registerUser(@Valid @RequestBody User user, BindingResult result) { if (result.hasErrors()) { Map errors = new HashMap<>(); result.getFieldErrors().forEach(error -> { errors.put(error.getField(), error.getDefaultMessage()); }); return ResponseEntity.badRequest().body(errors); } // Proceed with user registration return ResponseEntity.ok(userService.registerUser(user)); } ``` #### Step 4: Sanitize Inputs Use Apache Commons Text for input sanitization: ```java import org.apache.commons.text.StringEscapeUtils; @Service public class UserService { public User registerUser(User user) { // Sanitize inputs user.setUsername(StringEscapeUtils.escapeHtml4(user.getUsername())); user.setEmail(StringEscapeUtils.escapeHtml4(user.getEmail())); // Process password securely (don't sanitize password) // ... password handling logic return userRepository.save(user); } } ``` #### Step 5: Add Client-side Validation Add HTML5 validation attributes to your forms: ```html ``` #### Step 6: Handle Validation Errors Add error handling in your controller: ```java @PostMapping("/register") public ResponseEntity registerUser(@Valid @RequestBody User user, BindingResult result) { if (result.hasErrors()) { Map errors = new HashMap<>(); result.getFieldErrors().forEach(error -> { errors.put(error.getField(), error.getDefaultMessage()); }); return ResponseEntity.badRequest().body(errors); } try { return ResponseEntity.ok(userService.registerUser(user)); } catch (Exception e) { return ResponseEntity.internalServerError().body("Registration failed"); } } ``` #### Best Practices: - Always validate on both client and server side - Use secure password hashing algorithms - Regularly update your validation rules - Keep validation logic centralized - Monitor invalid input attempts #### Next Steps: - Implement security headers configuration - Set up logging for invalid input attempts - Regular security audits #### Further Reading: - [Hibernate Validator Documentation](https://docs.jboss.org/hibernate/stable/validator/reference/en-US/html_single/) - [OWASP Input Validation Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html) - [Spring Validation Documentation](https://docs.spring.io/spring/docs/current/spring-framework-reference/languages/java/annotation.html)