aprs.me/lib/aprsme_web
Graham McIntire 94f3a62539
Add comprehensive input sanitization for coordinate parsing
Security improvements:
- Added sanitize_numeric_string to remove dangerous characters
- Limited input string length to prevent DoS attacks (20 chars for numbers)
- Added is_finite? checks to prevent infinity/NaN values
- Validate coordinate ranges (lat: -90 to 90, lng: -180 to 180)
- Added safe_parse_coordinate with proper validation
- Updated to_float in EncodingUtils with security validations
- Protected against integer overflow in coordinate conversions
- Added sanitize_path_string for APRS path validation

All coordinate inputs from users are now:
1. Sanitized to remove injection characters
2. Length-limited to prevent resource exhaustion
3. Validated for finite values (no infinity/NaN)
4. Checked against valid geographic ranges
5. Given safe fallback defaults

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-07-14 10:20:10 -05:00
..
components main map improvements 2025-07-13 14:58:13 -05:00
controllers integrate /:call to main page 2025-07-13 10:36:58 -05:00
live Add comprehensive input sanitization for coordinate parsing 2025-07-14 10:20:10 -05:00
plugs badpackets formatting 2025-07-12 08:02:51 -05:00
aprs_symbol.ex refactor 2025-07-13 16:49:20 -05:00
endpoint.ex built in error tracking 2025-07-07 11:06:22 -05:00
gettext.ex more languages 2025-07-06 10:08:58 -05:00
router.ex integrate /:call to main page 2025-07-13 10:36:58 -05:00
telemetry.ex add packet batcher 2025-06-24 15:06:09 -05:00
time_helpers.ex main map improvements 2025-07-13 14:58:13 -05:00
time_utils.ex refactor and performance improvements 2025-07-10 10:53:34 -05:00
user_auth.ex refactor to use external parser 2025-06-24 14:22:09 -05:00
weather_units.ex fix nil weather units 2025-07-08 12:45:50 -05:00