VCST-4691: Add InputValidationOptions to prevent HTML/XSS injections

[OlegoO]

Description

feat: Adds InputValidationOptions to prevent HTML/XSS injections by adding NameValidationPattern, toggles HTML tag rejection for non-name fields (username, phone, address fields), toggles broader script injection check for free-text fields (about, description, message).

The module includes server-side input validation to prevent stored XSS attacks. Validation is configurable via appsettings.json under FrontendSecurity:InputValidation:

{
  "FrontendSecurity": {
    "InputValidation": {
      "NameValidationPattern": "^[\\p{L}\\p{M}\\s'\\-\\.]+$",
      "OrganizationNameValidationPattern": "^[\\p{L}\\p{M}\\p{N}\\s'\\-\\.&#/,()]+$",
      "EnableNoHtmlTagsValidation": true,
      "EnableScriptInjectionValidation": true
    }
  }
}

Setting	Default	Description
NameValidationPattern	^[\p{L}\p{M}\s'\-\.]+$	Allow-list regex for person name fields (firstName, lastName, fullName). Permits Unicode letters, diacritics, spaces, apostrophes, hyphens, and dots. Set to empty string to disable.
OrganizationNameValidationPattern	^[\p{L}\p{M}\p{N}\s'\-\.&#/,()]+$	Allow-list regex for organization name fields. Additionally permits numbers, &, #, /, ,, (, ) for names like "3M", "AT&T", "H&M". Set to empty string to disable.
EnableNoHtmlTagsValidation	true	Rejects HTML tags (<...>) in non-name fields (username, phone, address lines, city). Set to false to disable.
EnableScriptInjectionValidation	true	Rejects script injection patterns (<script>, javascript:, vbscript:, data:text/html) in free-text fields (description). Set to false to disable.

MaxLength constraints are always enforced regardless of configuration.

References

QA-test:

Jira-link:

https://virtocommerce.atlassian.net/browse/VCST-4713
https://virtocommerce.atlassian.net/browse/VCST-4691

Artifact URL:

https://vc3prerelease.blob.core.windows.net/packages/VirtoCommerce.ProfileExperienceApiModule_3.1002.0-pr-130-9776.zip

---

Note

Medium Risk
Adds new validation rules that can cause previously accepted contact/org/account/address/registration inputs to be rejected, impacting user-facing flows if clients rely on permissive input. Behavior is configurable but now enforced by default on multiple command handlers.

Overview
Introduces configurable InputValidationOptions (bound from FrontendSecurity:InputValidation) to enforce allow-list name/org-name regexes, max lengths, and optional rejection of HTML tags and common script-injection patterns.

Wires these FluentValidation checks into write paths (CreateOrganization, UpdateOrganization, UpdateContact, UpdateMemberAddresses, UpdatePersonalData, and RegisterByInvitation) and adds dedicated validators + extension rules, with new unit tests and README documentation for configuration. Also suppresses a specific NuGet audit advisory (GHSA-rvv3-g6hj-g44x).

^{Written by Cursor Bugbot for commit 9776e82. This will update automatically on new commits. Configure here.}

[vc-ci]

Test Suite: Test Suites/Modules/module_Assets
Tests: 13
Failures: 0
Errors: 0
Time: 7.783
Timestamp: 13-03-2026T10:29:13

[vc-ci]

Test Suite: Test Suites/Modules/module_Assets
Tests: 13
Failures: 0
Errors: 0
Time: 7.825
Timestamp: 13-03-2026T10:41:09

[vc-ci]

Test Suite: Test Suites/Modules/module_Assets
Tests: 13
Failures: 0
Errors: 0
Time: 7.785
Timestamp: 17-03-2026T07:14:30

[vc-ci]

Test Suite: Test Suites/Modules/module_Assets
Tests: 13
Failures: 0
Errors: 0
Time: 8.157
Timestamp: 17-03-2026T11:19:39

[vc-ci]

Test Suite: Test Suites/Modules/module_Assets
Tests: 13
Failures: 0
Errors: 0
Time: 7.91
Timestamp: 17-03-2026T11:36:51

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
26 Accepted issues

Measures
0 Security Hotspots
37.4% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[vc-ci]

Test Suite: Test Suites/Modules/module_Assets
Tests: 13
Failures: 0
Errors: 0
Time: 8.363
Timestamp: 17-03-2026T12:44:41