🛡️ Input Sanitization & Security Hardening

Purpose of the Change

This change introduces input sanitization mechanisms to the handling of user-influenced strings like backupName and query. These values are passed into APIs, UI keys, local storage, and internal logic. To ensure application resilience and reduce potential abuse vectors, we sanitize them to:

• Remove potentially dangerous characters
• Limit the input length
• Ensure only safe and expected data is used throughout the application

⚙️ What has changed

1. _sanitizePlaceName() added to _HomePageState

Used to clean the backupName field before it's used in API calls, logic branches, and UI widgets.

2.LocationService is created following best practices to to improve code readability and maintenance

3. _sanitizeQuery() added to LocationService

Used to clean the query parameter before being passed to weatherapi or OM APIs.

These functions ensure only:

• Word characters (a-zA-Z0-9_)
• Spaces
• Commas
• Dashes
  are accepted. Also, no more than 100 characters are processed to void Buffer overflows from extremely long inputs.

4. Using Uri.Https() instead of Uir.Http() that aligns with OWASP guidelines. Sensitive Data Exposure (OWASP Mobile Top 10: M1) and Insecure Communication (OWASP Mobile Top 10: M3).

📊 Impact of the Change

High-risk areas existed because:

• User input was passed unfiltered to API calls and dynamic widgets
• Special characters could break APIs or introduce unexpected behavior
• Excessively long strings could trigger crashes or logic failures

However, there was no critical vulnerabilities like RCE or injection, because:

• No direct string concatenation into shell commands or file writes occurred
• Third-party API calls used structured query params (e.g., Uri.https)

That said, failure to sanitize is still a high-risk code smell and leaves open potential for:

• Service disruption (DoS)
• Information leakage via cache/log poisoning
• Inconsistent app behavior across locales and edge cases

📚 OWASP Mobile Top 10 Compliance

These changes align with best practices and mitigate risks outlined in the OWASP Mobile Top 10.