Security: No input validation on data import — importAllData blindly trusts JSON payload #6

New issue

Closed

opened 2026-05-16 03:41:10 +00:00 by Mark · 1 comment

Mark commented

2026-05-16 03:41:10 +00:00

Owner

Severity: HIGH (data integrity)

Location

src/lib/db.ts:273-298 — importAllData() function

Description

importAllData() clears ALL IndexedDB tables and calls bulkAdd() on whatever data is passed with zero validation:

export async function importAllData(data: { people, interactions, gifts, dateEvents, groups, settings? }) {
  await db.transaction(rw, [...tables], async () => {
    await db.people.clear();
    await db.interactions.clear();
    // ...clears every table...
    await db.people.bulkAdd(data.people);    // no schema check
    await db.interactions.bulkAdd(data.interactions);  // no schema check
    // ...
  });
}

Impact

A corrupt, truncated, or malicious JSON import destroys all user data with no recovery path
If data.people contains objects missing required fields, Dexie silently stores garbage
No type validation is performed despite Zod v4 being available in the dependency tree

Recommendation

Add Zod schema validation before clearing any tables. Validate the full payload structure against defined schemas first, reject the import if validation fails, and surface clear error messages to the user.

Code context

src/lib/db.ts:273-298 — importAllData function
src/lib/types.ts — TypeScript interfaces exist but are compile-time only, no runtime guards
Zod v4 (zod@^4.3.5) is already installed but unused for validation

## Severity: HIGH (data integrity) ### Location `src/lib/db.ts:273-298` — `importAllData()` function ### Description `importAllData()` clears ALL IndexedDB tables and calls `bulkAdd()` on whatever data is passed with zero validation: ```typescript export async function importAllData(data: { people, interactions, gifts, dateEvents, groups, settings? }) { await db.transaction(rw, [...tables], async () => { await db.people.clear(); await db.interactions.clear(); // ...clears every table... await db.people.bulkAdd(data.people); // no schema check await db.interactions.bulkAdd(data.interactions); // no schema check // ... }); } ``` ### Impact - A corrupt, truncated, or malicious JSON import destroys all user data with no recovery path - If `data.people` contains objects missing required fields, Dexie silently stores garbage - No type validation is performed despite Zod v4 being available in the dependency tree ### Recommendation Add Zod schema validation before clearing any tables. Validate the full payload structure against defined schemas first, reject the import if validation fails, and surface clear error messages to the user. ### Code context - `src/lib/db.ts:273-298` — importAllData function - `src/lib/types.ts` — TypeScript interfaces exist but are compile-time only, no runtime guards - Zod v4 (`zod@^4.3.5`) is already installed but unused for validation