fix: amm-1930 wasa-validation added for sms template api #310
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.



📋 Description
JIRA ID: AMM-1930
🔒 Overview
Added comprehensive input validation and sanitization to the
/saveSMSTemplateendpoint to prevent XSS, SQL Injection, and Command Injection attacks. This enhancement implements a defense-in-depth approach with minimal code changes while maintaining backward compatibility.🎯 Problem
The SMS template creation endpoint lacked input validation controls, exposing the application to:
✅ Solution
Multi-Layer Security Implementation
1. Validation Layer (DTO Level)
CreateSMSRequestandSMSParameterMapModel<,>,;,|,$, etc.)2. Sanitization Layer (Service Level)
InputSanitizerutility class with three methods:sanitizeForXSS()- HTML encodes and removes script patternssanitizeForCommandInjection()- Strips shell metacharactersisValidTemplateParameter()- Validates template syntax safetysanitizeInputs()method inSMSServiceImplto clean all inputs before processing3. Exception Handling
ValidationExceptionHandlerfor consistent error responses📋 Key Changes
Files Modified
pom.xmlCreateSMSRequest.javaSMSParameterMapModel.javaSMSController.javaSMSServiceImpl.javaFiles Created
InputSanitizer.javaValidationExceptionHandler.javaTotal Changes: ~250 lines added/modified across 7 files
🛡️ Security Controls
Input Validation Rules
<or>characters<>\"';&|$(){}[]`)Attack Prevention
✅ XSS: Pattern validation + HTML encoding + script pattern removal
✅ Command Injection: Metacharacter filtering + template syntax validation
✅ SQL Injection: Enhanced validation layer (JPA parameterized queries already in place)
🧪 Testing
Validated against 6 security scenarios:
<script>alert('XSS')</script>; rm -rf /' OR '1'='1Example Responses
📊 Impact Assessment
✅ Positive Impact
🔄 Backward Compatibility
Rollback Plan
Simply revert this commit - no migrations or cleanup required.
📝 Review Notes
Type: Security Enhancement
Priority: High
Risk Level: Low (defensive changes, backward compatible)
Testing: Manual security testing completed
Dependencies: Added spring-boot-starter-validation
This PR implements industry-standard input validation practices to secure the SMS template creation endpoint with minimal code changes and zero breaking changes.