Custom field values have no server-side validation against field_type or select options #50

New Issue

2026-08-31T21:36:18-04:00

jared commented

2026-08-31 21:36:18 -04:00

Severity: Medium (latent — depends on the Custom Fields feature actually being wired up, see related issue)

CustomFieldModel::setValue() accepts any string for any field with no check against the field's field_type (text/textarea/select/checkbox/date/number), and for select-type fields there's no server-side check against the defined field_options.options list — validation, if it exists at all, would only happen client-side. Additionally, createDefinition()/updateDefinition() don't validate field_type against the six documented allowed values, so a malformed type could be stored and break whatever admin UI renders it.

Fix: Add server-side type/format validation in setValue() (e.g. numeric check for number, date format check for date, allowlist check for select/checkbox), and validate field_type against a fixed allowlist in the definition create/update endpoints.

**Severity:** Medium (latent — depends on the Custom Fields feature actually being wired up, see related issue) `CustomFieldModel::setValue()` accepts any string for any field with no check against the field's `field_type` (text/textarea/select/checkbox/date/number), and for `select`-type fields there's no server-side check against the defined `field_options.options` list — validation, if it exists at all, would only happen client-side. Additionally, `createDefinition()`/`updateDefinition()` don't validate `field_type` against the six documented allowed values, so a malformed type could be stored and break whatever admin UI renders it. **Fix:** Add server-side type/format validation in `setValue()` (e.g. numeric check for `number`, date format check for `date`, allowlist check for `select`/`checkbox`), and validate `field_type` against a fixed allowlist in the definition create/update endpoints.

jared added the priority/medium security labels 2026-09-08 10:15:45 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: LotusGuild/tinker_tickets#50