Skip to content

fix: Validate country field accepting numeric input #1714

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sashatakpere wants to merge 1 commit into
base: main
Choose a base branch
from
+9 −2
Open

fix: Validate country field accepting numeric input #1714

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 9 additions & 2 deletions frontend/src/pages/Settings/Settings.jsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -701,15 +701,22 @@ const Settings = () => {
<label className="block text-xs font-semibold text-slate-500 dark:text-slate-400 uppercase tracking-wider mb-2">
Country
</label>

<input
type="text"
value={country}
onChange={(e) => setCountry(e.target.value)}
onChange={(e) => {
const value = e.target.value;

if (/^[A-Za-z\s'-]*$/.test(value)) {

@coderabbitai coderabbitai Bot Aug 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Allow Unicode letters in country names.

The [A-Za-z] pattern rejects valid names such as Côte d'Ivoire and São Tomé and Príncipe. Use Unicode-aware validation or a canonical country list while preserving spaces, apostrophes, and hyphens.

🧰 Tools
🪛 ast-grep (0.45.0)

[warning] 711-711: Avoid using the initial state variable in setState
Context: setCountry(value)
Note: [CWE-710] Improper Adherence to Coding Standards. Security best practice.

(setstate-same-var)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@frontend/src/pages/Settings/Settings.jsx` at line 711, Update the
country-name validation in the Settings form to accept Unicode letters while
preserving spaces, apostrophes, and hyphens; replace the ASCII-only pattern in
the visible validation condition with Unicode-aware matching or canonical
country-list validation.

setCountry(value);
}
}}
placeholder="Enter Country"
className="w-full bg-slate-50 dark:bg-slate-900 border border-slate-200 dark:border-slate-800 rounded-lg py-2.5 px-4 text-sm text-slate-900 dark:text-white"
/>
Comment on lines 705 to 717

@coderabbitai coderabbitai Bot Aug 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

Enforce country validation on the API boundary.

This client-side filter does not protect persisted data. backend/controllers/authController.js:360-449 assigns req.body.country directly to user.country, so another client can store 11111111, India123, or ---. The regular expression also checks characters only. It does not verify that the value is a country name. Add server-side validation using one canonical country rule or country list.

🧰 Tools
🪛 ast-grep (0.45.0)

[warning] 711-711: Avoid using the initial state variable in setState
Context: setCountry(value)
Note: [CWE-710] Improper Adherence to Coding Standards. Security best practice.

(setstate-same-var)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@frontend/src/pages/Settings/Settings.jsx` around lines 705 - 717, Update the
backend country handling in the auth controller’s user-country assignment flow
to validate req.body.country against a canonical country-name rule or allowlist
before persisting it. Reject invalid values such as numeric-only, alphanumeric,
or punctuation-only strings, and ensure all clients receive the same validation
behavior regardless of the frontend filter.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Show an error and block save for invalid or empty country values.

The handler silently keeps the previous value when the user enters 11111111 or pastes India123. The input also has no required attribute. If the field starts empty, the form can submit an empty country without a validation message. Add validation state and an accessible error message, then reject save when country.trim() is empty or invalid.

🧰 Tools
🪛 ast-grep (0.45.0)

[warning] 711-711: Avoid using the initial state variable in setState
Context: setCountry(value)
Note: [CWE-710] Improper Adherence to Coding Standards. Security best practice.

(setstate-same-var)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@frontend/src/pages/Settings/Settings.jsx` around lines 705 - 717, Update the
country field and its form submission flow to track validation state, display an
accessible error message when the value is empty or fails the existing
country-character rule, and add the required attribute. Ensure onChange records
invalid input rather than silently retaining the previous value, and block save
until country.trim() is non-empty and valid.

</div>
</div>
</div>
<div className="border-t border-slate-200/60 dark:border-slate-800 pt-6">
<h3 className="text-lg font-bold text-slate-950 dark:text-white mb-6">
Educational Details
Expand Down
Loading