Validate user input

application/admin-client/cypress/e2e/families.cy.js

@@ -1,6 +1,7 @@
 /// <reference types="cypress" />
 
 const { TestUsers } = require('../../../common/testing/constants')
+const { VALIDATION_MESSAGES } = require('../../../common/src/validation')
 
 beforeEach(() => {
   cy.task('reset')
@@ -41,6 +42,34 @@ describe('Family Editing', () => {
     cy.get('[data-cy="in-study-checkbox"] input').last().should('be.checked')
   })
 
+  it('Cannot use xss first name when adding new dependent to family', () => {
+    cy.visit('/participants/family/edit/100')
+    cy.get('[data-cy="add-member-button"]').click()
+    cy.get('[data-cy="registered-no"]').click()
+    cy.get('[data-cy="new-dependent"]').click()
+    cy.get('[data-cy=dep-first]').type("{{7*7}}<script>alert('xss-dep-first')</script>$#", {
+      parseSpecialCharSequences: false,
+    })
+    cy.get('[data-cy=dep-surname]').type('Smith')
+    cy.get('[data-cy="dep-dob"]').type('2020-01-01')
+    cy.get('[data-cy="add-dep-button"]').click()
+    cy.contains(VALIDATION_MESSAGES.NAME_INVALID).should('exist')
+  })
+
+  it('Cannot use xss surname when adding new dependent to family', () => {
+    cy.visit('/participants/family/edit/100')
+    cy.get('[data-cy="add-member-button"]').click()
+    cy.get('[data-cy="registered-no"]').click()
+    cy.get('[data-cy="new-dependent"]').click()
+    cy.get('[data-cy=dep-first]').type('Alfred')
+    cy.get('[data-cy=dep-surname]').type("{{7*7}}<script>alert('xss-dep-surname')</script>$#", {
+      parseSpecialCharSequences: false,
+    })
+    cy.get('[data-cy="dep-dob"]').type('2020-01-01')
+    cy.get('[data-cy="add-dep-button"]').click()
+    cy.contains(VALIDATION_MESSAGES.NAME_INVALID).should('exist')
+  })
+
   it('Remove member from family', () => {
     cy.visit('/participants/family/edit/100')
     cy.get('[data-cy="remove-member-button"]').click()

application/admin-client/cypress/e2e/participants.cy.js

@@ -1,6 +1,7 @@
 /// <reference types="cypress" />
 
 const { TestUsers } = require('../../../common/testing/constants')
+const { VALIDATION_MESSAGES } = require('../../../common/src/validation')
 
 beforeEach(() => {
   cy.task('reset')
@@ -34,11 +35,11 @@ describe('Participants', () => {
     cy.get('input[name="profile.postcode"]').clear().type('222a')
     cy.get('input[name="externalId"]').clear().type('extID')
     cy.contains('Save').click()
-    cy.contains('Invalid postcode').should('exist')
+    cy.contains(VALIDATION_MESSAGES.POSTCODE_INVALID).should('exist')
     cy.get('input[name="profile.postcode"]').clear().type('2222')
     cy.get('input[name="profile.nextOfKin.email"]').clear().type('invalid')
     cy.contains('Save').click()
-    cy.contains('Invalid email').should('exist')
+    cy.contains(VALIDATION_MESSAGES.EMAIL_INVALID).should('exist')
     cy.get('input[name="profile.nextOfKin.email"]').clear().type('valid@email.com')
     cy.contains('Save').click()
     cy.url().should('contain', `participants/${TestUsers.PARTICIPANT_UNANSWERED.id}`)
@@ -68,4 +69,160 @@ describe('Participants', () => {
     cy.get('[data-rowindex="2"]').contains('V1').trigger('mouseover', { force: true })
     cy.contains('Incomplete').should('be.visible')
   })
+
+  it('Edit participant, validate xss first name', () => {
+    cy.login(TestUsers.ORG_ADMIN.email)
+    cy.visit(`/participants/edit/${TestUsers.PARTICIPANT_UNANSWERED.id}`)
+    cy.contains('Edit Participant').should('exist')
+    cy.get('input[name="profile.firstName"]')
+      .clear()
+      .type("{{7*7}}<script>alert('xss-first-name')</script>", {
+        parseSpecialCharSequences: false,
+      })
+    cy.contains('Save').click()
+    cy.contains(VALIDATION_MESSAGES.NAME_INVALID).should('exist')
+  })
+
+  it('Edit participant, validate xss last name', () => {
+    cy.login(TestUsers.ORG_ADMIN.email)
+    cy.visit(`/participants/edit/${TestUsers.PARTICIPANT_UNANSWERED.id}`)
+    cy.contains('Edit Participant').should('exist')
+    cy.get('input[name="profile.lastName"]')
+      .clear()
+      .type("{{7*7}}<script>alert('xss-last-name')</script>", {
+        parseSpecialCharSequences: false,
+      })
+    cy.contains('Save').click()
+    cy.contains(VALIDATION_MESSAGES.NAME_INVALID).should('exist')
+  })
+
+  it('Edit participant, validate xss email', () => {
+    cy.login(TestUsers.ORG_ADMIN.email)
+    cy.visit(`/participants/edit/${TestUsers.PARTICIPANT_UNANSWERED.id}`)
+    cy.contains('Edit Participant').should('exist')
+    cy.get('input[name="profile.email"]')
+      .clear()
+      .type("{{7*7}}<script>alert('xss-email')</script>@gmail.com", {
+        parseSpecialCharSequences: false,
+      })
+    cy.contains('Save').click()
+    cy.contains(VALIDATION_MESSAGES.EMAIL_INVALID).should('exist')
+  })
+
+  it('Edit participant, validate xss externalId', () => {
+    cy.login(TestUsers.ORG_ADMIN.email)
+    cy.visit(`/participants/edit/${TestUsers.PARTICIPANT_UNANSWERED.id}`)
+    cy.contains('Edit Participant').should('exist')
+    cy.get('input[name="externalId"]')
+      .clear()
+      .type("{{7*7}}<script>alert('xss-externalId')</script>", {
+        parseSpecialCharSequences: false,
+      })
+    cy.contains('Save').click()
+    cy.contains(VALIDATION_MESSAGES.EXTERNALID_INVALID).should('exist')
+  })
+
+  it('Edit participant, validate xss address', () => {
+    cy.login(TestUsers.ORG_ADMIN.email)
+    cy.visit(`/participants/edit/${TestUsers.PARTICIPANT_UNANSWERED.id}`)
+    cy.contains('Edit Participant').should('exist')
+    cy.get('input[name="profile.addressLine"]')
+      .clear()
+      .type("{{7*7}}<script>alert('xss-address')</script>", {
+        parseSpecialCharSequences: false,
+      })
+    cy.contains('Save').click()
+    cy.contains(VALIDATION_MESSAGES.ADDRESS_INVALID).should('exist')
+  })
+
+  it('Edit participant, validate xss suburb', () => {
+    cy.login(TestUsers.ORG_ADMIN.email)
+    cy.visit(`/participants/edit/${TestUsers.PARTICIPANT_UNANSWERED.id}`)
+    cy.contains('Edit Participant').should('exist')
+    cy.get('input[name="profile.suburb"]')
+      .clear()
+      .type("{{7*7}}<script>alert('xss-suburb')</script>", {
+        parseSpecialCharSequences: false,
+      })
+    cy.contains('Save').click()
+    cy.contains(VALIDATION_MESSAGES.ADDRESS_INVALID).should('exist')
+  })
+
+  it('Edit participant, validate xss postcode', () => {
+    cy.login(TestUsers.ORG_ADMIN.email)
+    cy.visit(`/participants/edit/${TestUsers.PARTICIPANT_UNANSWERED.id}`)
+    cy.contains('Edit Participant').should('exist')
+    cy.get('input[name="profile.postcode"]')
+      .clear()
+      .type("{{7*7}}<script>alert('xss-postcode')</script>", {
+        parseSpecialCharSequences: false,
+      })
+    cy.contains('Save').click()
+    cy.contains(VALIDATION_MESSAGES.POSTCODE_INVALID).should('exist')
+  })
+
+  it('Edit participant, validate xss mobile', () => {
+    cy.login(TestUsers.ORG_ADMIN.email)
+    cy.visit(`/participants/edit/${TestUsers.PARTICIPANT_UNANSWERED.id}`)
+    cy.contains('Edit Participant').should('exist')
+    cy.get('input[name="profile.mobile"]')
+      .clear()
+      .type("{{7*7}}<script>alert('xss-mobile')</script>", {
+        parseSpecialCharSequences: false,
+      })
+    cy.contains('Save').click()
+    cy.contains(VALIDATION_MESSAGES.MOBILE_INVALID).should('exist')
+  })
+
+  it('Edit participant, validate xss nok first name', () => {
+    cy.login(TestUsers.ORG_ADMIN.email)
+    cy.visit(`/participants/edit/${TestUsers.PARTICIPANT_UNANSWERED.id}`)
+    cy.contains('Edit Participant').should('exist')
+    cy.get('input[name="profile.nextOfKin.firstName"]')
+      .clear()
+      .type("{{7*7}}<script>alert('xss-nok-first-name')</script>", {
+        parseSpecialCharSequences: false,
+      })
+    cy.contains('Save').click()
+    cy.contains(VALIDATION_MESSAGES.NAME_INVALID).should('exist')
+  })
+
+  it('Edit participant, validate xss nok last name', () => {
+    cy.login(TestUsers.ORG_ADMIN.email)
+    cy.visit(`/participants/edit/${TestUsers.PARTICIPANT_UNANSWERED.id}`)
+    cy.contains('Edit Participant').should('exist')
+    cy.get('input[name="profile.nextOfKin.lastName"]')
+      .clear()
+      .type("{{7*7}}<script>alert('xss-nok-last-name')</script>", {
+        parseSpecialCharSequences: false,
+      })
+    cy.contains('Save').click()
+    cy.contains(VALIDATION_MESSAGES.NAME_INVALID).should('exist')
+  })
+
+  it('Edit participant, validate xss nok email', () => {
+    cy.login(TestUsers.ORG_ADMIN.email)
+    cy.visit(`/participants/edit/${TestUsers.PARTICIPANT_UNANSWERED.id}`)
+    cy.contains('Edit Participant').should('exist')
+    cy.get('input[name="profile.nextOfKin.email"]')
+      .clear()
+      .type("{{7*7}}<script>alert('xss-nok-email')</script>@gmail.com", {
+        parseSpecialCharSequences: false,
+      })
+    cy.contains('Save').click()
+    cy.contains(VALIDATION_MESSAGES.EMAIL_INVALID).should('exist')
+  })
+
+  it('Edit participant, validate xss nok mobile', () => {
+    cy.login(TestUsers.ORG_ADMIN.email)
+    cy.visit(`/participants/edit/${TestUsers.PARTICIPANT_UNANSWERED.id}`)
+    cy.contains('Edit Participant').should('exist')
+    cy.get('input[name="profile.nextOfKin.mobile"]')
+      .clear()
+      .type("{{7*7}}<script>alert('xss-nok-mobile')</script>", {
+        parseSpecialCharSequences: false,
+      })
+    cy.contains('Save').click()
+    cy.contains(VALIDATION_MESSAGES.MOBILE_INVALID).should('exist')
+  })
 })

application/admin-client/cypress/e2e/settings.cy.js

@@ -1,6 +1,7 @@
 /// <reference types="cypress" />
 
 const { TestUsers } = require('../../../common/testing/constants')
+const { VALIDATION_MESSAGES } = require('../../../common/src/validation')
 
 beforeEach(() => {
   cy.task('reset')
@@ -52,31 +53,6 @@ describe('Settings page', () => {
     )
   })
 
-  it('Invalid values prevent saving and show appropriate error messages', () => {
-    const values = { ...fieldMap, primaryColour: 'abc' }
-
-    cy.visit('/settings')
-
-    cy.get('[data-cy="tcLink"] input').should(
-      'have.value',
-      'https://garvan-data-science-platform.github.io/ctrl-docs/docs/terms-and-conditions',
-    )
-
-    for (const [key, value] of Object.entries(values)) {
-      cy.get(`[data-cy="${key}"] input`).clear().type(value)
-    }
-    cy.get('[data-cy="save-button"]').click()
-
-    cy.contains('Invalid colour').should('exist')
-
-    for (const [key, value] of Object.entries(fieldMap)) {
-      cy.get(`[data-cy="${key}"] input`).clear().type(value)
-    }
-
-    cy.contains('Invalid colour').should('not.exist')
-    cy.contains('Invalid url').should('not.exist')
-  })
-
   it('Can upload a logo', () => {
     cy.visit('/settings')
     cy.uploadCommonFile('[data-cy="logo-upload"]', 'valid_logo.png')
@@ -160,4 +136,85 @@ describe('Settings page', () => {
     cy.contains('Deleted logo').should('exist')
     cy.get('[data-cy="logo-preview"]').should('not.exist')
   })
+
+  it('Invalid tcLink url prevent saving and show appropriate error messages', () => {
+    cy.visit('/settings')
+
+    cy.get('[data-cy="tcLink"] input').clear().type("{{7*7}}<script>alert('xss-tcLink')</script>", {
+      parseSpecialCharSequences: false,
+    })
+
+    cy.get('[data-cy="save-button"]').click()
+
+    cy.contains(VALIDATION_MESSAGES.URL_INVALID).should('exist')
+  })
+
+  it('Invalid newsLink url prevent saving and show appropriate error messages', () => {
+    cy.visit('/settings')
+
+    cy.get('[data-cy="newsLink"] input')
+      .clear()
+      .type("{{7*7}}<script>alert('xss-newsLink')</script>", {
+        parseSpecialCharSequences: false,
+      })
+
+    cy.get('[data-cy="save-button"]').click()
+
+    cy.contains(VALIDATION_MESSAGES.URL_INVALID).should('exist')
+  })
+
+  it('Invalid primary colour prevent saving and show appropriate error messages', () => {
+    const values = { ...fieldMap, primaryColour: 'abc' }
+
+    cy.visit('/settings')
+
+    for (const [key, value] of Object.entries(values)) {
+      cy.get(`[data-cy="${key}"] input`).clear().type(value)
+    }
+    cy.get('[data-cy="save-button"]').click()
+
+    cy.contains('Invalid colour').should('exist')
+
+    for (const [key, value] of Object.entries(fieldMap)) {
+      cy.get(`[data-cy="${key}"] input`).clear().type(value)
+    }
+
+    cy.contains('Invalid colour').should('not.exist')
+  })
+
+  it('Invalid xss primary colour prevent saving and show appropriate error messages', () => {
+    const values = {
+      ...fieldMap,
+      primaryColour: "{{7*7}}<script>alert('xss-primary-colour')</script>",
+    }
+
+    cy.visit('/settings')
+
+    for (const [key, value] of Object.entries(values)) {
+      cy.get(`[data-cy="${key}"] input`).clear().type(value, {
+        parseSpecialCharSequences: false,
+      })
+    }
+    cy.get('[data-cy="save-button"]').click()
+
+    cy.contains('Invalid colour').should('exist') //TODO: move to common?
+  })
+
+  it('Invalid xss secondary colour prevent saving and show appropriate error messages', () => {
+    const values = {
+      ...fieldMap,
+      secondaryColour: "{{7*7}}<script>alert('xss-secondary-colour')</script>",
+    }
+
+    cy.visit('/settings')
+
+    for (const [key, value] of Object.entries(values)) {
+      cy.get(`[data-cy="${key}"] input`).clear().type(value, {
+        parseSpecialCharSequences: false,
+      })
+    }
+    cy.get('[data-cy="save-button"]').click()
+
+    cy.contains('Invalid colour').should('exist') //TODO: move to common?
+  })
 })

application/admin-client/cypress/e2e/setup.cy.js

@@ -1,5 +1,6 @@
 /// <reference types="cypress" />
 const { TestUsers } = require('../../../common/testing/constants')
+const { VALIDATION_MESSAGES } = require('../../../common/src/validation')
 
 describe('Setup', () => {
   it('Redirects to setup page if database empty, can register', () => {
@@ -13,4 +14,29 @@ describe('Setup', () => {
     cy.visit('/surveys')
     cy.contains('Current Draft').should('exist')
   })
+
+  it('Cannot register with xss', () => {
+    cy.task('wipe')
+    cy.visit('/')
+    cy.url().should('contain', '/setup')
+    cy.get('[data-cy="setup-email"]').type(
+      "{{7*7}}<script>alert('xss-dep-first')</script>@gmail.com",
+      {
+        parseSpecialCharSequences: false,
+      },
+    )
+    cy.get('[data-cy="setup-password"]').type(TestUsers.ORG_ADMIN.password) // Using test data to conform to pr requirements
+    cy.get('[data-cy="setup-submit"]').click()
+    cy.contains(VALIDATION_MESSAGES.EMAIL_INVALID).should('exist')
+  })
+
+  it('Cannot register with weak password', () => {
+    cy.task('wipe')
+    cy.visit('/')
+    cy.url().should('contain', '/setup')
+    cy.get('[data-cy="setup-email"]').type('abc@d.com')
+    cy.get('[data-cy="setup-password"]').type('password')
+    cy.get('[data-cy="setup-submit"]').click()
+    cy.contains('Invalid password').should('exist')
+  })
 })