Skip to content

Contact form lacks sanitization #943

New issue
New issue
Closed
#1046
Closed
Contact form lacks sanitization#943
#1046
Assignees
Unclebaffa
Labels
Stellar WaveIssues in the Stellar wave program

Description

@DevMuhdishaq
DevMuhdishaq
opened on Oct 12, 2026

Problem

The contact form in components/ContactForm.tsx does not validate that the email address field contains a valid format, and does not sanitize the message body before sending to the backend. This could allow XSS attacks through the message body and invalid email submissions.

Why it matters

Unvalidated contact form:

  1. XSS vulnerabilities if message body is rendered without sanitization
  2. Invalid email submissions waste backend resources
  3. Spam and abuse through unvalidated forms
  4. Poor data quality in the contacts database

Suggested Direction

  1. Add email regex validation to the email field in ContactForm.tsx.
  2. Sanitize the message body using DOMPurify or similar library before sending to backend.
  3. Add rate limiting on the contact form submission endpoint.
  4. Add honeypot field or reCAPTCHA integration to prevent bot submissions.
  5. Write a test asserting the validation and sanitization work.
  6. Check components/NewsletterForm.tsx and components/QueryForm.tsx for the same gaps.

Acceptance Criteria

  • Contact form validates email address format
  • Message body is sanitized before backend submission
  • Rate limiting prevents form spam
  • Honeypot or reCAPTCHA prevents bot submissions
  • Test covers validation, sanitization, and rate limiting
  • No contact form submissions accept invalid data or XSS payloads
  • All forms in the app sanitize user input

Related

components/ContactForm.tsx, components/NewsletterForm.tsx, components/QueryForm.tsx, lib/sanitize.ts, utils/rate-limit.ts

Activity

  1. ranjeet150 commented on Oct 14, 2026

    @ranjeet150
    ranjeet150
    on Oct 14, 2026

    Hello,

    I am interested in taking up "Contact form lacks sanitization" and implementing a production-grade solution.

    Technical Implementation Outline:

    1. Review contract state storage keys, TTL policies, and auth guards (Address::require_auth).
    2. Implement safe state transition logic with checked arithmetic preventing under/overflow.
    3. Write comprehensive Soroban unit tests covering standard flows, unauthorized callers, and reverts.
    4. Verify contract execution footprint passes Soroban CPU/memory budget limits.

    Please assign this issue to me. I will submit a clean, well-tested, and production-ready PR promptly!

  2. drips-wave
    added
    Stellar WaveIssues in the Stellar wave program
    on Oct 18, 2026

  3. olapadenew commented on Oct 18, 2026

    @olapadenew
    olapadenew
    on Oct 18, 2026 – with Drips Wave

    @olapadenew has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

    Hi maintainer if you could mind assiging this issue to this

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @olapadenew to this issue.

  4. CollinsKRO commented on Oct 18, 2026

    @CollinsKRO
    CollinsKRO
    on Oct 18, 2026 – with Drips Wave

    @CollinsKRO has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

    Hi Maintainer, I can fix this pls assign. ETA 5hrs

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @CollinsKRO to this issue.

  5. laxjovial commented on Oct 18, 2026

    @laxjovial
    laxjovial
    on Oct 18, 2026 – with Drips Wave

    @laxjovial has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

    Hello maintainer, i would like to work on this issue

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @laxjovial to this issue.

  6. Unclebaffa commented on Oct 18, 2026

    @Unclebaffa
    Unclebaffa
    on Oct 18, 2026 – with Drips Wave
    Contributor

    @Unclebaffa has applied to work on this issue as part of the Stellar Wave Program's 10th wave.

    I'd be happy to take this issue on. I have experience building production-ready applications and collaborating effectively through GitHub workflows, including implementing features, resolving bugs, and submitting well-documented pull requests.

    I'll carefully review the existing implementation, identify the root cause, and deliver a robust, maintainable solution that aligns with the project's architecture and coding standards. Before submitting my PR, I'll thoroughly test the changes to ensure reliability and avoid regressions.

    My goal is to contribute high-quality, clean, and maintainable code while communicating clearly throughout the process and delivering a dependable solution in a timely manner.

    ℹ️ Repo Maintainers: To accept this application, review their application or assign @Unclebaffa to this issue.

  7. ayshadogo
    assigned
    Unclebaffa
    on Oct 18, 2026

  8. drips-wave commented on Oct 18, 2026

    @drips-wave
    drips-waveBot
    on Oct 18, 2026 – with Drips Wave

    Congratulations, @Unclebaffa! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on October 22, 2026.

    🧑‍💻 @Unclebaffa: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

    Warning

    When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

    🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

    🌊 Happy Wave 🌊

  9. Unclebaffa
    added a commit that references this issue on Oct 21, 2026

    fix: sanitize forms, validate APIs, check stake balance, fix theme (D…

    354b8eb
  10. ayshadogo
    closed this as completedin #1046on Oct 22, 2026

  11. grantfox-oss commented on Oct 22, 2026

    @grantfox-oss
    grantfox-ossBot
    on Oct 22, 2026 – with GrantFox OSS

    🎉 This issue has been marked as completed on GrantFox!

    @Unclebaffa's PR #1046 was approved and merged by @ayshadogo.

    🏆 @Unclebaffa: You earned 45 FoxPoints for this contribution! Your current tier: Specialist (5,717 total points). Track your full progress on GrantFox.

    👏 Great work, @Unclebaffa! Keep contributing to Dfunder.

  12. drips-wave commented on Oct 22, 2026

    @drips-wave
    drips-waveBot
    on Oct 22, 2026 – with Drips Wave

    This issue has been completed by @Unclebaffa as part of the Stellar Wave Program's 10th Wave 🥳

    😎 @Unclebaffa: You earned 200 Points for completing this issue! Once the Wave's rewards are finalized, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.

    🧑‍💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Stellar WaveIssues in the Stellar wave program

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions