This document outlines the comprehensive input sanitization and security measures implemented for the Medusa 2.0 registration forms.

• HTML Tag Removal: Strips all HTML tags and script elements
• JavaScript URL Prevention: Removes javascript: URLs
• Event Handler Removal: Removes inline event handlers (onclick, onload, etc.)

• Quote Escaping: Properly escapes single and double quotes
• SQL Keyword Filtering: Removes dangerous SQL keywords (UNION, SELECT, INSERT, etc.)
• Comment Removal: Strips SQL comment patterns (--, /* */)

• Names: Alphanumeric, spaces, hyphens, periods, apostrophes only (max 100 chars)
• Team Names: Alphanumeric, spaces, hyphens, underscores, periods only (max 50 chars)
• Emails: Lowercase, valid email characters only (max 254 chars)
• Phone Numbers: Digits, spaces, +, -, () only (max 20 chars)
• Universities: Safe punctuation allowed (max 200 chars)
• File Names: Safe file name characters only (max 255 chars)

• Regex pattern: /^[^\s@]+@[^\s@]+\.[^\s@]+$/
• Maximum length: 254 characters
• Case insensitive

• Regex pattern: /^[\+]?[1-9][\d]{0,15}$/
• Length: 8-15 digits (excluding formatting)
• International format support

• Length: 2-100 characters
• Pattern: /^[a-zA-Z\s\-.']+$/
• No numbers or special characters

• Length: 2-50 characters
• Pattern: /^[a-zA-Z0-9\s\-_.]+$/
• Alphanumeric with safe punctuation

• Memory-based tracking: Stores attempt timestamps per identifier
• Sliding window: Configurable time window for attempt counting
• Automatic cleanup: Removes old attempts outside the window

• Team Info Step: 3 attempts per 1 minute
• Member Details Step: 3 attempts per 5 minutes
• Payment Step: 2 attempts per 10 minutes

• MIME Type Check: Validates against allowed MIME types
• Extension Validation: Double-checks file extensions
• Allowed Types: JPEG, PNG, PDF only

• Maximum Size: 5MB per file
• Minimum Size: 1KB (prevents empty/corrupted files)

• Character Filtering: Only safe file name characters
• Length Limit: Maximum 255 characters
• Space Replacement: Spaces converted to underscores

• Content-Type: application/json
• X-Content-Type-Options: nosniff
• X-Frame-Options: DENY
• X-XSS-Protection: 1; mode=block
• Referrer-Policy: strict-origin-when-cross-origin

• Generic Error Messages: Prevents information leakage
• Rate Limit Responses: Clear feedback for rate limiting
• Validation Feedback: User-friendly validation error messages

• Input sanitization on all text fields
• Real-time validation with error display
• Rate limiting on form submission
• Sanitized data passed to next step

• Member data sanitization and validation
• Individual field validation with specific error messages
• API request with security headers
• Enhanced error handling

• File upload validation and sanitization
• File name sanitization
• MIME type and extension validation
• Rate limiting for payment submissions

1. Input Capture: User types in form fields
2. Real-time Feedback: Validation errors cleared when user starts typing
3. Form Submission:
   • Rate limiting check
   • Data sanitization
   • Comprehensive validation
   • Sanitized data processing
4. API Request: Secure headers and sanitized payload
5. Error Handling: User-friendly error messages

• XSS Attacks: HTML/script injection prevented
• SQL Injection: Database query manipulation blocked
• File Upload Attacks: Malicious file uploads prevented
• Rate Limiting: Brute force and spam attacks mitigated
• Data Injection: Special character filtering applied

• Clear Validation: Real-time feedback on input errors
• Rate Limit Feedback: Clear messages when limits exceeded
• File Upload Guidance: Specific file type and size requirements
• Error Recovery: Easy correction of validation errors

1. XSS Testing: Attempt to inject <script> tags and JavaScript
2. SQL Injection Testing: Try common SQL injection patterns
3. File Upload Testing: Upload malicious files and oversized files
4. Rate Limiting Testing: Submit forms rapidly to test limits
5. Validation Testing: Submit invalid data in all fields

1. Valid Data Flow: Complete registration with valid data
2. Validation Messages: Verify error messages display correctly
3. File Upload Flow: Test successful file uploads
4. Cross-browser Testing: Ensure compatibility across browsers

• MIME Type List: Update allowed file types as needed
• Rate Limits: Adjust based on legitimate usage patterns
• Validation Patterns: Update regex patterns for new requirements
• Security Headers: Keep headers updated with latest security standards

• Rate Limit Hits: Monitor for unusual rate limit patterns
• Validation Failures: Track common validation errors
• File Upload Attempts: Monitor for malicious file uploads
• API Error Rates: Track registration success/failure rates