validation of date only fields in backend to prevent misuse

Author: chpy04

src/backend/src/routes/calendar.routes.ts

@@ -3,6 +3,7 @@ import { body, param } from 'express-validator';
 import {
   intMinZero,
   isDate,
+  isDateOnly,
   nonEmptyString,
   validateInputs,
   isEventStatus,
@@ -185,7 +186,7 @@ calendarRouter.post(
   body('availability').isArray(),
   body('availability.*.availability').isArray(),
   intMinZero(body('availability.*.availability.*')),
-  isDate(body('availability.*.dateSet')),
+  isDateOnly(body('availability.*.dateSet')),
   validateInputs,
   CalendarController.markUserConfirmed
 );

src/backend/src/routes/change-requests.routes.ts

@@ -38,7 +38,14 @@ changeRequestsRouter.post(
   intMinZero(body('wbsNum.projectNumber')),
   intMinZero(body('wbsNum.workPackageNumber')),
   body('type').custom((value) => value === ChangeRequestType.Activation),
-  body('startDate').custom((value) => !isNaN(Date.parse(value))),
+  body('startDate').custom((value) => {
+    const parsed = Date.parse(value);
+    if (isNaN(parsed)) return false;
+    const date = new Date(parsed);
+    return (
+      date.getUTCHours() === 0 && date.getUTCMinutes() === 0 && date.getUTCSeconds() === 0 && date.getUTCMilliseconds() === 0
+    );
+  }),
   nonEmptyString(body('leadId')),
   nonEmptyString(body('managerId')),
   body('confirmDetails').isBoolean(),

src/backend/src/routes/recruitment.routes.ts

@@ -1,5 +1,5 @@
 import express from 'express';
-import { isDate, nonEmptyString, validateInputs } from '../utils/validation.utils.js';
+import { isDateOnly, nonEmptyString, validateInputs } from '../utils/validation.utils.js';
 import { body } from 'express-validator';
 import RecruitmentController from '../controllers/recruitment.controllers.js';
 
@@ -12,7 +12,7 @@ recruitmentRouter.post(
   '/milestone/create',
   nonEmptyString(body('name')),
   nonEmptyString(body('description')),
-  isDate(body('dateOfEvent')),
+  isDateOnly(body('dateOfEvent')),
   validateInputs,
   RecruitmentController.createMilestone
 );
@@ -21,7 +21,7 @@ recruitmentRouter.post(
   '/milestone/:milestoneId/edit',
   nonEmptyString(body('name')),
   nonEmptyString(body('description')),
-  isDate(body('dateOfEvent')),
+  isDateOnly(body('dateOfEvent')),
   validateInputs,
   RecruitmentController.editMilestone
 );

src/backend/src/routes/reimbursement-requests.routes.ts

@@ -8,7 +8,7 @@ import { body } from 'express-validator';
 import {
   intMinZero,
   isDate,
-  isOptionalDate,
+  isOptionalDateOnly,
   nonEmptyString,
   validateInputs,
   validateReimbursementProducts
@@ -115,7 +115,7 @@ reimbursementRequestsRouter.post('/:vendorId/vendors/delete', ReimbursementReque
 
 reimbursementRequestsRouter.post(
   '/create',
-  isOptionalDate(body('dateOfExpense')),
+  isOptionalDateOnly(body('dateOfExpense')),
   nonEmptyString(body('vendorId')),
   nonEmptyString(body('indexCodeId')),
   nonEmptyString(body('accountCodeId')),
@@ -131,7 +131,7 @@ reimbursementRequestsRouter.get('/:requestId', ReimbursementRequestController.ge
 
 reimbursementRequestsRouter.post(
   '/:requestId/edit',
-  isOptionalDate(body('dateOfExpense')),
+  isOptionalDateOnly(body('dateOfExpense')),
   nonEmptyString(body('vendorId')),
   nonEmptyString(body('indexCodeId')),
   body('receiptPictures').isArray(),

src/backend/src/routes/tasks.routes.ts

@@ -1,7 +1,13 @@
 import express from 'express';
 import { body } from 'express-validator';
 import TasksController from '../controllers/tasks.controllers.js';
-import { nonEmptyString, isTaskPriority, isTaskStatus, validateInputs, isOptionalDate } from '../utils/validation.utils.js';
+import {
+  nonEmptyString,
+  isTaskPriority,
+  isTaskStatus,
+  validateInputs,
+  isOptionalDateOnly
+} from '../utils/validation.utils.js';
 import { isDate } from '../utils/validation.utils.js';
 
 const tasksRouter = express.Router();
@@ -21,8 +27,8 @@ tasksRouter.post(
 tasksRouter.post(
   '/:wbsNum',
   nonEmptyString(body('title')),
-  isOptionalDate(body('deadline')),
-  isOptionalDate(body('startDate')),
+  isOptionalDateOnly(body('deadline')),
+  isOptionalDateOnly(body('startDate')),
   body('notes').isString(),
   isTaskPriority(body('priority')),
   isTaskStatus(body('status')),
@@ -36,8 +42,8 @@ tasksRouter.post(
   '/:taskId/edit',
   nonEmptyString(body('title')),
   nonEmptyString(body('notes')),
-  isOptionalDate(body('deadline')),
-  isOptionalDate(body('startDate')),
+  isOptionalDateOnly(body('deadline')),
+  isOptionalDateOnly(body('startDate')),
   isTaskPriority(body('priority')),
   TasksController.editTask
 );

src/backend/src/routes/users.routes.ts

@@ -2,7 +2,7 @@ import { Theme } from '@prisma/client';
 import express from 'express';
 import { body } from 'express-validator';
 import UsersController from '../controllers/users.controllers.js';
-import { isRole, nonEmptyString, intMinZero, validateInputs, isDate } from '../utils/validation.utils.js';
+import { isRole, nonEmptyString, intMinZero, validateInputs, isDateOnly } from '../utils/validation.utils.js';
 
 const userRouter = express.Router();
 
@@ -50,7 +50,7 @@ userRouter.post(
   body('availability').isArray(),
   body('availability.*.availability').isArray(),
   intMinZero(body('availability.*.availability.*')),
-  isDate(body('availability.*.dateSet')),
+  isDateOnly(body('availability.*.dateSet')),
   validateInputs,
   UsersController.setUserScheduleSettings
 );

src/backend/src/routes/work-packages.routes.ts

@@ -5,7 +5,7 @@ import {
   blockedByValidators,
   descriptionBulletsValidators,
   intMinZero,
-  isDate,
+  isDateOnly,
   isWorkPackageStageOrNone,
   nonEmptyString,
   validateInputs
@@ -35,7 +35,7 @@ workPackagesRouter.post(
   nonEmptyString(body('crId').optional()),
   nonEmptyString(body('name')),
   isWorkPackageStageOrNone(body('stage')),
-  isDate(body('startDate')),
+  isDateOnly(body('startDate')),
   intMinZero(body('duration')),
   intMinZero(body('projectWbsNum.carNumber')),
   intMinZero(body('projectWbsNum.projectNumber')),
@@ -51,7 +51,7 @@ workPackagesRouter.post(
   nonEmptyString(body('workPackageId')),
   nonEmptyString(body('crId')),
   nonEmptyString(body('name')),
-  isDate(body('startDate')),
+  isDateOnly(body('startDate')),
   intMinZero(body('duration')),
   isWorkPackageStageOrNone(body('stage')),
   ...blockedByValidators,
@@ -65,7 +65,7 @@ workPackagesRouter.delete('/:wbsNum/delete', WorkPackagesController.deleteWorkPa
 workPackagesRouter.get('/:wbsNum/blocking', WorkPackagesController.getBlockingWorkPackages);
 workPackagesRouter.post(
   '/slack-upcoming-deadlines',
-  isDate(body('deadline')),
+  isDateOnly(body('deadline')),
   validateInputs,
   WorkPackagesController.slackMessageUpcomingDeadlines
 );

src/backend/src/utils/validation.utils.ts

@@ -87,6 +87,28 @@ export const isOptionalDate = (validationObject: ValidationChain): ValidationCha
   return validationObject.optional().custom((value) => !isNaN(Date.parse(value)));
 };
 
+export const isDateOnly = (validationObject: ValidationChain): ValidationChain => {
+  return validationObject.custom((value) => {
+    const parsed = Date.parse(value);
+    if (isNaN(parsed)) return false;
+    const date = new Date(parsed);
+    return (
+      date.getUTCHours() === 0 && date.getUTCMinutes() === 0 && date.getUTCSeconds() === 0 && date.getUTCMilliseconds() === 0
+    );
+  });
+};
+
+export const isOptionalDateOnly = (validationObject: ValidationChain): ValidationChain => {
+  return validationObject.optional().custom((value) => {
+    const parsed = Date.parse(value);
+    if (isNaN(parsed)) return false;
+    const date = new Date(parsed);
+    return (
+      date.getUTCHours() === 0 && date.getUTCMinutes() === 0 && date.getUTCSeconds() === 0 && date.getUTCMilliseconds() === 0
+    );
+  });
+};
+
 export const validateReimbursementProducts = () => {
   return [
     body('otherReimbursementProducts').isArray(),
@@ -117,7 +139,7 @@ export const workPackageProposedChangesValidators = (base: string) => [
   nonEmptyString(body(`${base}.leadId`).optional()),
   nonEmptyString(body(`${base}.managerId`).optional()),
   isWorkPackageStageOrNone(workPackageProposedChangesExists(body(`${base}.stage`).optional())),
-  isDate(workPackageProposedChangesExists(body(`${base}.startDate`))),
+  isDateOnly(workPackageProposedChangesExists(body(`${base}.startDate`))),
   intMinZero(workPackageProposedChangesExists(body(`${base}.duration`))),
   workPackageProposedChangesExists(body(`${base}.blockedBy`)).isArray(),
   intMinZero(body(`${base}.blockedBy.*.carNumber`)),