feat: implement API security measures phase 1

api/jobs/serializers.py

@@ -3,6 +3,20 @@ from rest_framework import serializers
 from .models import JobApplication, JobUpdate
 
 
+class SanitizedCharField(serializers.CharField):
+    """CharField that strips control characters on deserialization."""
+
+    def to_internal_value(self, data: object) -> object:
+        value = super().to_internal_value(data)
+        if isinstance(value, str):
+            value = value.strip()
+            if "\x00" in value:
+                raise serializers.ValidationError("Input contains invalid characters.")
+            import re
+            value = re.sub(r"[\x00-\x08\x0b\x0c\x0e-\x1f]", "", value)
+        return value
+
+
 class JobUpdateSerializer(serializers.ModelSerializer):
     company_name = serializers.CharField(source="job_application.company_name", read_only=True)
     position_title = serializers.CharField(source="job_application.position_title", read_only=True)
@@ -24,10 +38,16 @@ class JobUpdateSerializer(serializers.ModelSerializer):
 
 
 class JobApplicationSerializer(serializers.ModelSerializer):
+    user_id = serializers.IntegerField(read_only=True)
+    notes = SanitizedCharField(required=False, allow_blank=True, default="")
+    company_name = SanitizedCharField(max_length=255)
+    position_title = SanitizedCharField(max_length=255)
+
     class Meta:
         model = JobApplication
         fields = [
             "id",
+            "user_id",
             "company_name",
             "position_title",
             "status",
@@ -35,6 +55,11 @@ class JobApplicationSerializer(serializers.ModelSerializer):
             "created_at",
             "updated_at",
         ]
+        read_only_fields = ["user_id"]
+
+    def create(self, validated_data):
+        validated_data["user"] = self.context["request"].user
+        return super().create(validated_data)
 
 
 class DashboardMetricsSerializer(serializers.Serializer):