---
id: w6/m6/t003
title: Injection/input-validation audit — REST/GraphQL/MCP
worker: worker6
status: done
estimate: 45m
depends_on: []
---

## Objective

Audit the REST/GraphQL/MCP surfaces in `lego/backend/` for injection risk: SQL construction, webhook HMAC verification, and build-pipeline argument handling.

## Context

- Control-plane Postgres queries (`BEX_CP_DB_URI` path) — check for string-concatenated SQL vs parameterized queries.
- Git push webhook (`POST /v1/webhooks/git`, `BEX_WEBHOOK_SECRET`) — verify HMAC comparison is constant-time and covers the full raw body.
- Build-pipeline fields (repo URL, branch, root directory) that flow into BuildKit Job specs — check for command/argument injection via untrusted user input.

## Steps

1. Grep `lego/backend/` for raw SQL string formatting/concatenation; confirm all queries are parameterized.
2. Review the webhook handler's HMAC verification for timing-safe comparison and correct signature scope.
3. Trace repo/branch/root-directory fields from API input through to the BuildKit Job spec construction in the operator; confirm no shell interpolation of untrusted values.
4. Record findings for t007.

## Files

- `lego/backend/internal/**` (webhook handler, control-plane store queries)
- `lego/operator/internal/**` (build Job construction)

## Acceptance criteria

- [ ] SQL query construction confirmed parameterized (or fixed where not).
- [ ] Webhook HMAC verification confirmed constant-time and full-body.
- [ ] Build-pipeline argument handling confirmed injection-safe (or fixed).

## Out of scope

- GraphQL/REST authorization checks (covered by existing OpenFGA work, not this audit).
