Validators & Input Security

danger

AquaGen API prevents SQL injection via the @validate_values() decorator, applied on every Cosmos DB query method before the query string is built. Never skip this decorator on any Queries method.

---

@validate_values() (app/security_checks/input_validator.py)

Every method in Queries (and DatabaseSupporter where applicable) is decorated with @validate_values(). It intercepts all string arguments before the query string is built and rejects any value that matches known injection patterns.

from app.security_checks.input_validator import validate_values

class Queries:
    @staticmethod
    @validate_values()
    def get_my_feature_data(industry_id, date):
        return f'SELECT * FROM c WHERE c.industryId = "{industry_id}" AND c.date = "{date}"'

How it works:

1. Inspects every argument passed to the decorated function.
2. For each str argument, calls string_validator(key, value).
3. string_validator runs a regex against the value — it matches:
   • SQL comment markers: --, /*, */
   • Statement terminators: ;
   • String delimiters: '
   • Fullwidth SQL keywords (Unicode lookalike attack): ＯＲ, ＡＮＤ, ＵＮＩＯＮ, ＳＥＬＥＣＴ, ＩＮＳＥＲＴ, ＵＰＤＡＴＥ, ＤＥＬＥＴＥ, ＤＲＯＰ, ＥXＥＣ, ＳＬＥＥＰ, etc.
4. On match, raises ValidationError(message, status_code=405) — the route layer catches this and returns a 405.

Skipping a parameter:

Pass a rules_dict with 'IGNORE' for arguments that are known-safe or pre-validated elsewhere:

@validate_values(rules_dict={'raw_query': 'IGNORE'})
def get_data_raw(industry_id, raw_query):
    ...

note

Non-string arguments (integers, lists, dicts) pass through without regex checking.