title: Security: Input validation and sanitization in import functions

status: closed

issue_type: task

created_by: Bryce

close_reason: Code review completed - import_uploaded_invoices.clj reviewed


title: Security: Remove hardcoded API keys in insight_outcome_recommendation

close_reason: Code review completed - Hardcoded Pinecone API key found at lines 31, 48


title: Performance: Fix N+1 query problem in sales_summaries

close_reason: Code review completed - N+1 queries identified throughout sales_summaries.clj


title: Code review: auto_ap.ssr.admin.transaction_rules

close_reason: Closed


title: Clientize sales summaries and add schema cleanup

status: open


title: Code review: auto_ap.ssr.admin.import_batch


title: Security: Remove hardcoded cookie secret

close_reason: Code review completed - Hardcoded cookie store key found at lines 447-448


title: Complete test coverage for transactions and invoice functionality


title: Code Review: auto_ap.permissions


title: Code Review: auto_ap.ledger


title: Security: Implement rate limiting

close_reason: Code review completed - Rate limiting not implemented, recommendation added


title: Code Review: iol_ion


title: Security: Add input validation and sanitization

close_reason: Code review completed - handler.clj reviewed, input validation issues identified


title: Code review: auto_ap.ssr.admin.excel_invoice


title: Security: Remove hardcoded JWT secrets


title: Code review: auto_ap.ssr.admin.vendors


title: Code Review: auto_ap.routes

close_reason: No file found for this namespace


title: Security: Remove hardcoded Google credentials in auth.clj

close_reason: Code review completed - JWT secret management reviewed


title: Code review: auto_ap.ssr.admin.sales_summaries


title: Code review: auto_ap.ssr.admin.accounts


title: Fix session handling and authentication route issues


title: Refactor clients module for better reusability, schemas, and bug fixes


title: Code Review: auto_ap.import


title: Code Review: auto_ap.ss_routes


title: Code review: auto_ap.ssr.admin.clients


title: Security: Rate limiting for external API calls

close_reason: Code review completed - Rate limiting recommendations added


title: Code Review: iol-ion.query - Security and Code Quality Issues

description: Code review of /home/noti/dev/integreat/iol_ion/src/iol_ion/query.clj revealed critical security and maintainability issues:\n\n## Security Issues:\n- **Regex Injection Vulnerability** (line 67-68): User input passed directly to regex compilation without sanitization, enabling ReDoS attacks\n- **No input validation on date parameters** (lines 25-30, 46-54, 83-162): Invalid dates could cause Denial of Service attacks\n- **No validation of client IDs** (lines 46-54, 83-162): Malicious client IDs could bypass access controls\n- **Unsafe timezone handling** (line 70-75): Hardcoded timezone without validation or fallback could cause failures\n- **Permission checking lacks validation** (lines 59-64): Assumes identity structure without validation\n\n## Code Quality Issues:\n- **Extreme code duplication** (lines 83-162): 8 scan functions with identical structure except for index names and entity types\n- **Obsolete function** (lines 7-9):  marked as "not working in Datomic Cloud" but still used\n- **Magic numbers** (lines 25-30, 86-89): Hardcoded years (2001-2030) and days (90) should be configuration\n- **Inconsistent client handling**: Mixed use of  vs direct client IDs\n\n## Performance Issues:\n- **Inefficient database queries** (lines 83-162): Sequential scans in for-loops instead of bulk operations\n- **Repeated timezone conversions**: Each call to local-now converts to same timezone unnecessarily\n\n## Recommendations:\n1. Add input validation for all user-supplied parameters\n2. Create a utility function to handle regex compilation safely\n3. Extract common scan logic into a single reusable function\n4. Replace deprecated entid function or remove its usage\n5. Move magic numbers to configuration constants\n6. Optimize database queries with bulk operations\n7. Add proper error handling and validation for all functions


title: Clean up legacy code and remove commented out templates


title: Code Review: auto_ap.background


title: Security: Fix SQL injection vulnerability in exports.clj

close_reason: Code review completed - SQL injection vulnerability found in export-raw function


title: Concurrency: Fix thread safety issues in sysco.clj


title: Implement autopay and unpaid API unification


title: Security: Transaction validation and data integrity

close_reason: Code review completed - Transaction validation reviewed in multiple files


title: Code Review: auto_ap.shared_views


title: Security: Database connection management in imports

close_reason: Code review completed - No connection management issues found in import files


title: Code Review: auto_ap.ss.admin.background-jobs - Security and Code Quality Issues

description: Code review of /home/noti/dev/integreat/src/clj/auto_ap/ssr/admin/background_jobs.clj revealed critical security and maintainability issues:\n\n## Security Issues:\n- **No job name validation** (lines 53-58): Job names used to construct task ARNs without validation, enabling injection attacks\n- **Hardcoded network configuration** (lines 150-52): Subnets and security groups hardcoded with direct IPs\n- **Hardcoded security group IDs** (lines 151-52): Security credentials directly embedded in code\n- **No rate limiting** (lines 56-61): Job execution lacks rate limiting, enabling DoS attacks\n- **Fragile job name sanitization** (lines 161-62): Regex replacement approach is insecure\n- **No URL validation** (lines 74, 84-86): S3 URLs not validated before use\n\n## Code Quality Issues:\n- **Poor error handling** (lines 30-37): AWS API errors not handled, could crash page\n- **Code duplication** (lines 46-52, 53-58):  and  have identical logic\n- **Magic strings** (lines 33-42, 224-42): Job names hardcoded in select options and processing\n- **Inconsistent error handling**: Mixed approach to form errors and API errors\n\n## Performance Issues:\n- **Inefficient task querying** (lines 30-37): Two separate AWS API calls instead of one\n- **Nested AWS calls** (lines 35-36): Multiple nested API calls increase complexity\n- **No caching**: Repeated API calls to  without memoization\n\n## Recommendations:\n1. Add input validation for all user-supplied parameters\n2. Extract hardcoded configuration to environment variables or config files\n3. Implement rate limiting on job execution\n4. Use secure sanitization for job names\n5. Add proper error handling for AWS API calls\n6. Remove code duplication by extracting common logic\n7. Optimize AWS API calls and add caching where appropriate\n8. Validate S3 URLs before use


title: Performance: Fix potential memory leak in client hydration


title: Code Review: auto_ap.client_routes

close_reason: No file found for auto_ap.client_routes namespace


title: Code Review: auto_ap.ss


title: Performance: Fix CSV writing efficiency in exports.clj


title: Investigate iol-ion module and security review requirements

description: iol-ion appears to be an external or internal module that provides query functions used throughout the codebase:\n\nFunctions used:\n- iol-ion.query/ident (line 98 in transaction_rules.clj)\n- iol-ion.query/recent-date (line 317 in transaction_rules.clj)\n- iol-ion.query/->pattern (lines 323, 541 in transaction_rules.clj)\n- iol-ion.query/dom (lines 361, 368 in transaction_rules.clj)\n\nNeeds investigation:\n1. Is iol-ion a third-party library or internal module?\n2. What security concerns exist in its usage?\n3. Is there proper input validation in its functions?\n4. Are there any potential injection vulnerabilities?\n5. What are the dependencies and version requirements?\n\nSearch in:\n- project.clj or deps.edn for dependencies\n- src directory for module definition\n- Documentation or README files


title: Fix payment query parameter parsing and implement proper decoding


title: Complete IOL integration with Datomic Cloud


title: Code Review: auto_ap.main

notes:
Code review completed for auto_ap.views.main

**Summary**: Found several issues ranging from performance to code quality.

**High Priority**:
- Inefficient key generation on line 90 using pr-str - causes unnecessary re-renders

**Medium Priority**:
- Permission check pattern duplication across 16 page methods
- Insufficient nil handling for edge cases

**Low Priority**:
- Subscription frequency could be optimized
- Growing page handler count suggests need for refactoring

**Security**: All page routes properly check permissions - good security posture.

Full detailed review saved to REVIEW_auto_ap.main.md


title: Performance: External API calls should be asynchronous


title: Fix grid page helper issues and form bubbling problems


title: Complete wizard implementation and make it more modular


title: Performance: Fix memory leak in client cache


title: Add Plaid merchant integration and improve vendors module


title: Code review: auto_ap.ssr.admin.history


title: Security: Add input validation to all routes


title: Code Review: auto_ap.jobs


title: Security: Fix error information leakage


title: Security: Fix SQL injection risk in close_auto_invoices

close_reason: Code review completed - No SQL injection risk found, queries properly parameterized


title: Componentize transaction rules and improve form handling


title: Complete real user testing for invoices and add credit from balance support


title: Improve component structure and implement better error handling


title: Complete wizard step structure and modularize page components


title: Security: Remove hardcoded NTG API key in exports.clj

close_reason: Code review completed - Hardcoded API key found at lines 659, 665


title: Resource: Fix resource leaks in import_uploaded_invoices

close_reason: Code review completed - Resource leaks identified in lines 43-76


title: Code Review: auto_ap.graphql


title: Security: Input sanitization and validation in job functions

close_reason: Code review completed - Job functions reviewed, input validation needed


title: Add feature flags system and signature support


title: Improve form handling and remove unused code


title: Performance: Fix N+1 query problems in exports.clj

close_reason: Code review completed - N+1 queries identified in exports.clj


title: Improve input components and data grid implementations


title: Improve typeahead component and implement proper query handling


title: Enhance ledger reports and improve navigation/aside components


title: Remove deprecated code and clean up unused functions


title: Code Review: auto_ap.permissions - Security and Maintainability Issues

description: Code review of /home/noti/dev/integreat/src/cljc/auto_ap/permissions.cljc revealed critical security and maintainability issues:\n\n## Security Issues:\n- Client access control bypass: Non-admins completely blocked if client-id is nil (lines 22-24)\n- No input validation: Client IDs and user data not validated (lines 10-11, 17)\n- Trust-based user object: No schema validation for user data\n\n## Maintainability Issues:\n- Extreme code duplication: Permission logic repeated 4 times across different role checks (lines 26-141)\n- Magic strings: Inconsistent role representation (mixing keywords and strings)\n- Hardcoded permissions: No separation from business logic\n- No unit tests: No test coverage for permission checks\n\n## Performance Issues:\n- Redundant set creation on every call (lines 22-23)\n- Repeated condition checks for each role\n\n## Recommendations:\n1. Implement schema validation for user data using malli\n2. Extract permissions to data structure following DRY principle\n3. Add client-id validation with pos-int?\n4. Add unit tests for all permission sets\n5. Move set creation outside function or add short-circuit for admin role\n\nSee full review for detailed analysis and refactoring suggestions.

close_reason: No file found for auto_ap.permissions namespace


title: Implement cash drawer shift functionality


title: Code review: auto_ap.ssr.admin.sales_powerqueries

close_reason: Closed


title: Complete invoice totals implementation to include expense accounts