Merge branch 'develop' into TM-309

internal/inquiry/handler.go

@@ -5,8 +5,8 @@ import (
 	"tm/pkg/hcaptcha"
 	"tm/pkg/logger"
 	"tm/pkg/response"
+	"tm/pkg/security"
 
-	"github.com/asaskevich/govalidator"
 	"github.com/labstack/echo/v4"
 )
 
@@ -15,14 +15,16 @@ type Handler struct {
 	service          Service
 	logger           logger.Logger
 	hcaptchaVerifier hcaptcha.Verifier
+	xssPolicy        *security.XSSPolicy
 }
 
 // NewInquiryHandler creates a new inquiry handler
-func NewHandler(service Service, logger logger.Logger, hcaptchaVerifier hcaptcha.Verifier) *Handler {
+func NewHandler(service Service, logger logger.Logger, hcaptchaVerifier hcaptcha.Verifier, xssPolicy *security.XSSPolicy) *Handler {
 	return &Handler{
 		service:          service,
 		logger:           logger,
 		hcaptchaVerifier: hcaptchaVerifier,
+		xssPolicy:        xssPolicy,
 	}
 }
 
@@ -45,8 +47,8 @@ func (h *Handler) CreateInquiry(c echo.Context) error {
 		return response.BadRequest(c, "Invalid request format", "")
 	}
 
-	// Validate form
-	if _, err := govalidator.ValidateStruct(form); err != nil {
+	// Validate and sanitize form
+	if err := form.ValidateAndSanitize(h.xssPolicy); err != nil {
 		return response.ValidationError(c, err.Error(), "")
 	}
 
@@ -136,8 +138,8 @@ func (h *Handler) UpdateInquiryStatus(c echo.Context) error {
 		return response.BadRequest(c, "Invalid request format", "")
 	}
 
-	// Validate form
-	if _, err := govalidator.ValidateStruct(form); err != nil {
+	// Validate and sanitize form
+	if err := form.ValidateAndSanitize(h.xssPolicy); err != nil {
 		return response.ValidationError(c, err.Error(), "")
 	}
 
@@ -177,8 +179,8 @@ func (h *Handler) SearchInquiries(c echo.Context) error {
 		return response.BadRequest(c, "Invalid request format", "")
 	}
 
-	// Validate form
-	if _, err := govalidator.ValidateStruct(form); err != nil {
+	// Validate and sanitize form
+	if err := form.ValidateAndSanitize(h.xssPolicy); err != nil {
 		return response.ValidationError(c, err.Error(), "")
 	}