Clean up and fix issues

backend/routes/account.py

@@ -313,6 +313,8 @@ def set_public_key(payload: dict, current_user: User = Depends(get_current_user)
     pk = payload.get("publicKey")
     if not pk:
         raise HTTPException(status_code=400, detail="publicKey required")
+    if not isinstance(pk, str) or len(pk) > 10000 or len(pk) < 10:
+        raise HTTPException(status_code=400, detail="Invalid publicKey format")
     row = db.query(CryptoPublicKey).filter(CryptoPublicKey.user_id == current_user.id).first()
     if row:
         row.public_key_b64 = pk
@@ -334,6 +336,8 @@ def set_backup(payload: dict, current_user: User = Depends(get_current_user), db
     blob = payload.get("blob")
     if not blob:
         raise HTTPException(status_code=400, detail="blob required")
+    if not isinstance(blob, str) or len(blob) > 1000000:  # 1MB limit
+        raise HTTPException(status_code=400, detail="Invalid blob format or size exceeds 1MB")
     row = db.query(CryptoBackup).filter(CryptoBackup.user_id == current_user.id).first()
     if row:
         row.blob_json = blob

backend/routes/devices.py

@@ -60,6 +60,9 @@ def revoke_device(
     current_user: User = Depends(get_current_user),
     db: Session = Depends(get_db)
 ):
+    if not session_id or len(session_id) > 64 or len(session_id) < 1:
+        raise HTTPException(status_code=400, detail="Invalid session ID")
+    
     s = (
         db.query(DeviceSession)
         .filter(DeviceSession.user_id == current_user.id, DeviceSession.session_id == session_id)

backend/routes/messaging.py

@@ -198,7 +198,7 @@ def convert_message(msg: Message) -> dict:
     }
 
 
-def convert_dm_envelope(envelope: DMEnvelope) -> dict:
+def convert_dm_envelope(db: Session, envelope: DMEnvelope) -> dict:
     # Group reactions by emoji
     reactions_dict = {}
     if envelope.reactions:
@@ -217,9 +217,6 @@ def convert_dm_envelope(envelope: DMEnvelope) -> dict:
             })
 
     # Get sender info for verified status
-    from models import User
-    from dependencies import get_db
-    db = next(get_db())
     sender = db.query(User).filter(User.id == envelope.sender_id).first()
 
     # Handle deleted or suspended users
@@ -454,9 +451,25 @@ async def dm_send(
         if key not in payload:
             raise HTTPException(status_code=400, detail=f"Missing {key}")
 
+    try:
+        recipient_id = int(payload["recipientId"])
+    except (ValueError, TypeError):
+        raise HTTPException(status_code=400, detail="Invalid recipientId")
+    
+    if recipient_id <= 0:
+        raise HTTPException(status_code=400, detail="Invalid recipientId")
+    
+    if recipient_id == current_user.id:
+        raise HTTPException(status_code=400, detail="Cannot send DM to yourself")
+    
+    # Verify recipient exists
+    recipient = db.query(User).filter(User.id == recipient_id).first()
+    if not recipient or recipient.deleted or recipient.suspended:
+        raise HTTPException(status_code=404, detail="Recipient not found")
+
     env = DMEnvelope(
         sender_id=current_user.id,
-        recipient_id=int(payload["recipientId"]),
+        recipient_id=recipient_id,
         iv_b64=payload["iv"],
         ciphertext_b64=payload["ciphertext"],
         salt_b64=payload["salt"],
@@ -590,6 +603,17 @@ async def dm_fetch(request: Request, since: int | None = None, current_user: Use
 @router.get("/dm/history/{other_user_id}")
 @rate_limit_per_ip("60/minute")  # Per-IP limit to prevent abuse
 async def dm_history(request: Request, other_user_id: int, current_user: User = Depends(get_current_user), db: Session = Depends(get_db)):
+    if other_user_id <= 0:
+        raise HTTPException(status_code=400, detail="Invalid user ID")
+    
+    if other_user_id == current_user.id:
+        raise HTTPException(status_code=400, detail="Cannot get history with yourself")
+    
+    # Verify other user exists
+    other_user = db.query(User).filter(User.id == other_user_id).first()
+    if not other_user or other_user.deleted or other_user.suspended:
+        raise HTTPException(status_code=404, detail="User not found")
+    
     return convert_envelopes(
         db.query(DMEnvelope)
         .filter(
@@ -631,7 +655,7 @@ async def get_dm_conversations(request: Request, current_user: User = Depends(ge
 
             result.append({
                 "user": convert_user(other_user),
-                "lastMessage": convert_dm_envelope(latest_message),
+                "lastMessage": convert_dm_envelope(db, latest_message),
                 "unreadCount": unread_count
             })
 
@@ -833,7 +857,7 @@ async def add_dm_reaction(
     # Refresh envelope to get updated reactions
     db.refresh(envelope)
 
-    envelope_data = convert_dm_envelope(envelope)
+    envelope_data = convert_dm_envelope(db, envelope)
 
     # Broadcast reaction update to both participants
     try:

backend/routes/profile.py

@@ -275,6 +275,9 @@ async def get_user_by_username(
     """
     Get user profile by username
     """
+    if not username or not is_valid_username(username):
+        raise HTTPException(status_code=400, detail="Invalid username format")
+    
     user = db.query(User).filter(User.username == username).first()
     
     if not user:
@@ -322,6 +325,9 @@ async def get_user_by_id(
     """
     Get user profile by user ID
     """
+    if user_id <= 0:
+        raise HTTPException(status_code=400, detail="Invalid user ID")
+    
     user = db.query(User).filter(User.id == user_id).first()
     
     if not user: