CP-10361 - Simplify ATS prefill values processing

- Remove redundant logging and validation checks
- Streamline error handling with early returns
- Simplify hash validation logic
- Reduce code complexity while maintaining security
pull/544/head
Bernardo Anderson 4 months ago
parent ca85f002f5
commit e82a2ecee5

@ -109,35 +109,19 @@ class SubmitFormController < ApplicationController
return {} if params[:ats_values].blank? return {} if params[:ats_values].blank?
# Security: Limit input size to prevent DoS attacks (64KB limit) # Security: Limit input size to prevent DoS attacks (64KB limit)
if params[:ats_values].bytesize > 65_536 return {} if params[:ats_values].bytesize > 65_536
Rails.logger.warn "ATS prefill values parameter exceeds size limit: #{params[:ats_values].bytesize} bytes"
return {}
end
begin begin
decoded_json = Base64.urlsafe_decode64(params[:ats_values]) decoded_json = Base64.urlsafe_decode64(params[:ats_values])
# Security: Limit decoded JSON size as well # Security: Limit decoded JSON size as well
if decoded_json.bytesize > 32_768 return {} if decoded_json.bytesize > 32_768
Rails.logger.warn "ATS prefill decoded JSON exceeds size limit: #{decoded_json.bytesize} bytes"
return {}
end
ats_values = JSON.parse(decoded_json) ats_values = JSON.parse(decoded_json)
# Validate that we got a hash # Validate that we got a hash
if ats_values.is_a?(Hash) ats_values.is_a?(Hash) ? ats_values : {}
# Audit logging: Log ATS prefill usage for security monitoring rescue StandardError
Rails.logger.info "ATS prefill values processed for submitter: #{@submitter&.slug || 'unknown'}, " \
"field_count: #{ats_values.keys.length}, " \
"account: #{@submitter&.account&.name || 'unknown'}"
ats_values
else
Rails.logger.warn "ATS prefill values not a hash: #{ats_values.class}"
{}
end
rescue StandardError => e
Rails.logger.warn "Failed to parse ATS prefill values: #{e.message}"
{} {}
end end
end end

Loading…
Cancel
Save