[Medium] TrailValidator does not validate GeoJSON type or coordinate structure #63

New Issue

2026-05-05T04:15:49Z

spikerj commented

2026-05-05 04:15:49 +00:00

Severity: Medium (data integrity)

File: SpikerSoft.Business/Domain/Map/Trails/Validation/TrailValidator.cs (~148-176)

Problem: ValidateGeometry only checks non-null, serializability, and size limits. Invalid GeoJSON type or malformed coordinate structures can be stored and then fail or mis-deserialize on read paths. Combined with TrailGeometry's LineString-oriented shape, multi-part geometries silently break.

Fix: Validate:

type is in allowlist (LineString, MultiLineString if supported, etc.)
coordinates has correct depth/shape for the declared type
Each coordinate pair has valid lat/lng ranges

Acceptance criteria:

Invalid type rejected before storage
Malformed coordinates rejected before storage
Unit tests cover invalid-type, invalid-shape, invalid-range cases

**Severity:** Medium (data integrity) **File:** `SpikerSoft.Business/Domain/Map/Trails/Validation/TrailValidator.cs` (~148-176) **Problem:** `ValidateGeometry` only checks non-null, serializability, and size limits. Invalid GeoJSON `type` or malformed coordinate structures can be stored and then fail or mis-deserialize on read paths. Combined with `TrailGeometry`'s LineString-oriented shape, multi-part geometries silently break. **Fix:** Validate: - `type` is in allowlist (`LineString`, `MultiLineString` if supported, etc.) - `coordinates` has correct depth/shape for the declared type - Each coordinate pair has valid lat/lng ranges **Acceptance criteria:** - [ ] Invalid `type` rejected before storage - [ ] Malformed coordinates rejected before storage - [ ] Unit tests cover invalid-type, invalid-shape, invalid-range cases

spikerj commented

2026-05-05 04:46:42 +00:00

Resolved.

TrailValidator.ValidateGeometry now performs structural GeoJSON validation:

Allowlists type against { LineString, MultiLineString }
Verifies coordinates is an array with the correct depth/shape for the declared type
New helper ValidateLineStringCoordinates enforces ≥ 2 coordinates, ≤ MaxCoordinatesCount, each pair has 2-3 numeric components, and uses the existing ValidateCoordinate for lat/lng range checks
MultiLineString validates total coordinate count across all lines
Existing size-limit and serialization checks retained

File: SpikerSoft.Business/Domain/Map/Trails/Validation/TrailValidator.cs.

**Resolved.** `TrailValidator.ValidateGeometry` now performs structural GeoJSON validation: - Allowlists `type` against `{ LineString, MultiLineString }` - Verifies `coordinates` is an array with the correct depth/shape for the declared type - New helper `ValidateLineStringCoordinates` enforces ≥ 2 coordinates, ≤ `MaxCoordinatesCount`, each pair has 2-3 numeric components, and uses the existing `ValidateCoordinate` for lat/lng range checks - `MultiLineString` validates total coordinate count across all lines - Existing size-limit and serialization checks retained File: `SpikerSoft.Business/Domain/Map/Trails/Validation/TrailValidator.cs`.

spikerj closed this issue

2026-05-05 04:51:57 +00:00

spikerj referenced this issue

2026-07-13 21:53:51 +00:00

[CI][Angular] Frontend pipeline does 4x duplicate Angular builds + an unnecessary arm-runner build leg — dedupe via build-once/artifact + buildx multi-arch (PR incoming) #549

spikerj referenced this issue

2026-07-13 21:59:34 +00:00

[Security][Prod] nginx root bind publicly serves quarantine, raw uploads, dlls — /spikersoft/<private-tree> downloadable #542

Sign in to join this conversation.