⚠️ [HIGH] Validation Middleware is a No-Op Pass-Through

[ayomideadeniran]

Description

The validateInput middleware function in backend/src/middleware/validation.js does nothing — it calls next() immediately without any validation logic.

Location

backend/src/middleware/validation.js:

export function validateInput(req, res, next) {
  next();
}

Impact

This middleware is imported and used in routes like backend/src/routes/v1/synthetic-assets.js:

import { validateInput } from ../../middleware/validation.js;

Routes that depend on this for input validation are processing unvalidated user input, which is a security risk.

Required Fix

Implement actual request validation in validation.js, including:

• Body schema validation
• Parameter sanitization
• Type checking for expected input fields
• Consider using a validation library (Joi, Zod, or similar)

Reference

Identified during full codebase audit of soroban-playground.

[Elizzy01]

@Elizzy01 has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi there, I'd like to work on this.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Elizzy01 to this issue.

[Waffiyyi]

@Waffiyyi has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

I would love to work on this issue. Please assign this to me.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Waffiyyi to this issue.

[AvatarMiiDe]

@AvatarMiiDe has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hello,
I’ve assessed the issue and I’m ready to execute. Please assign it to me. I will handle it and close it out promptly.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @AvatarMiiDe to this issue.

[Victorjonah-prog]

@Victorjonah-prog has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi Maintainer,I’d like to fix #996 — Validation Middleware is a No-Op.I’ll implement proper input validation in validateInput middleware (body schema, sanitization, type checking) using a library like Zod or Joi, and update the affected routes.Critical security fix — can deliver a solid PR quickly. Please assign it to me.Thanks!

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Victorjonah-prog to this issue.

[drips-wave]

Congratulations, @Victorjonah-prog! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on July 30, 2026.

🧑‍💻 @Victorjonah-prog: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊