fix: Validate country field accepting numeric input - #1714
Conversation
📝 WalkthroughWalkthroughThe Country input now validates entered characters. It stores only letters, spaces, apostrophes, and hyphens. Invalid input is ignored. ChangesCountry validation
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@frontend/src/pages/Settings/Settings.jsx`:
- Line 711: Update the country-name validation in the Settings form to accept
Unicode letters while preserving spaces, apostrophes, and hyphens; replace the
ASCII-only pattern in the visible validation condition with Unicode-aware
matching or canonical country-list validation.
- Around line 705-717: Update the backend country handling in the auth
controller’s user-country assignment flow to validate req.body.country against a
canonical country-name rule or allowlist before persisting it. Reject invalid
values such as numeric-only, alphanumeric, or punctuation-only strings, and
ensure all clients receive the same validation behavior regardless of the
frontend filter.
- Around line 705-717: Update the country field and its form submission flow to
track validation state, display an accessible error message when the value is
empty or fails the existing country-character rule, and add the required
attribute. Ensure onChange records invalid input rather than silently retaining
the previous value, and block save until country.trim() is non-empty and valid.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: b902a7a4-ebb6-4f55-aeed-9315dd3a9c36
📒 Files selected for processing (1)
frontend/src/pages/Settings/Settings.jsx
| <input | ||
| type="text" | ||
| value={country} | ||
| onChange={(e) => setCountry(e.target.value)} | ||
| onChange={(e) => { | ||
| const value = e.target.value; | ||
|
|
||
| if (/^[A-Za-z\s'-]*$/.test(value)) { | ||
| setCountry(value); | ||
| } | ||
| }} | ||
| placeholder="Enter Country" | ||
| className="w-full bg-slate-50 dark:bg-slate-900 border border-slate-200 dark:border-slate-800 rounded-lg py-2.5 px-4 text-sm text-slate-900 dark:text-white" | ||
| /> |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
Enforce country validation on the API boundary.
This client-side filter does not protect persisted data. backend/controllers/authController.js:360-449 assigns req.body.country directly to user.country, so another client can store 11111111, India123, or ---. The regular expression also checks characters only. It does not verify that the value is a country name. Add server-side validation using one canonical country rule or country list.
🧰 Tools
🪛 ast-grep (0.45.0)
[warning] 711-711: Avoid using the initial state variable in setState
Context: setCountry(value)
Note: [CWE-710] Improper Adherence to Coding Standards. Security best practice.
(setstate-same-var)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@frontend/src/pages/Settings/Settings.jsx` around lines 705 - 717, Update the
backend country handling in the auth controller’s user-country assignment flow
to validate req.body.country against a canonical country-name rule or allowlist
before persisting it. Reject invalid values such as numeric-only, alphanumeric,
or punctuation-only strings, and ensure all clients receive the same validation
behavior regardless of the frontend filter.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Show an error and block save for invalid or empty country values.
The handler silently keeps the previous value when the user enters 11111111 or pastes India123. The input also has no required attribute. If the field starts empty, the form can submit an empty country without a validation message. Add validation state and an accessible error message, then reject save when country.trim() is empty or invalid.
🧰 Tools
🪛 ast-grep (0.45.0)
[warning] 711-711: Avoid using the initial state variable in setState
Context: setCountry(value)
Note: [CWE-710] Improper Adherence to Coding Standards. Security best practice.
(setstate-same-var)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@frontend/src/pages/Settings/Settings.jsx` around lines 705 - 717, Update the
country field and its form submission flow to track validation state, display an
accessible error message when the value is empty or fails the existing
country-character rule, and add the required attribute. Ensure onChange records
invalid input rather than silently retaining the previous value, and block save
until country.trim() is non-empty and valid.
| onChange={(e) => { | ||
| const value = e.target.value; | ||
|
|
||
| if (/^[A-Za-z\s'-]*$/.test(value)) { |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Allow Unicode letters in country names.
The [A-Za-z] pattern rejects valid names such as Côte d'Ivoire and São Tomé and Príncipe. Use Unicode-aware validation or a canonical country list while preserving spaces, apostrophes, and hyphens.
🧰 Tools
🪛 ast-grep (0.45.0)
[warning] 711-711: Avoid using the initial state variable in setState
Context: setCountry(value)
Note: [CWE-710] Improper Adherence to Coding Standards. Security best practice.
(setstate-same-var)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@frontend/src/pages/Settings/Settings.jsx` at line 711, Update the
country-name validation in the Settings form to accept Unicode letters while
preserving spaces, apostrophes, and hyphens; replace the ASCII-only pattern in
the visible validation condition with Unicode-aware matching or canonical
country-list validation.
|
@sashatakpere Coderabbit suggestions seems to be important, kindly take a look on it |
2 participants
📝 Pull Request Description
Related Issue
Closes #786
Summary
Fixed the Country field in the profile form to prevent numeric and invalid alphanumeric input.
Previously, the Country field accepted values such as
11111111without validation. Validation has now been added so that the field accepts valid country-name characters while rejecting numeric and alphanumeric input.Type of Change
How Has This Been Tested?
Describe the testing steps performed.
India.United States.11111111and confirmed it is rejected.India123and confirmed it is rejected.Screenshots (if applicable)
N/A
Checklist
Summary