Bug: Skill assessment endpoints lack input validation, enabling assessment fraud and crashes

[anshul23102]

Problem Statement

DevPath does not implement request validation on skill assessment API endpoints, allowing users to submit invalid or malicious payloads that crash the assessment engine or cause incorrect skill level calculations. Attackers can manipulate responses to claim false skill levels.

Root Cause Analysis

Assessment endpoints lack input schema validation. No bounds checking on score values. Malformed JSON or unexpected data types cause unhandled exceptions. No rate limiting prevents test submission spam.

Solution Overview

1. Implement strict input validation using JSON schema validation library
2. Add type checking and bounds verification on all inputs
3. Implement rate limiting on assessment submissions
4. Add comprehensive error handling with safe error messages
5. Implement assessment answer verification against solution key
6. Add tamper detection (verify responses match expected submission flow)
7. Log suspicious assessment attempts

Type of Change

• Bug fix (security/reliability)
• New feature
• Breaking change
• Documentation update

Testing Done

Environment

• Node.js 18.x+
• JSON schema validator
• Test input fuzzing

Manual Testing Steps

Test Case 1: Invalid score submission

1. Submit skill assessment with score: 999999 (invalid)
2. Observe response

Expected: Request rejected with validation error
Actual: Score accepted, user skill level inflated to unrealistic level

Test Case 2: Malformed JSON

1. Submit: "{broken json: unclosed"
2. Check error handling

Expected: Graceful 400 Bad Request response
Actual: Server crashes with 500 error

Related Issue

Prevents skill level fraud and maintains assessment integrity.

Suggested Labels

bug, level:intermediate, gssoc26, security, validation, assessment, input-validation

[gamana618]

Hi @maintainer,

I would like to work on this issue.

Approach:

1. Analyze the current skill assessment API endpoints and identify validation gaps.
2. Implement schema-based request validation for all assessment payloads.
3. Add type checking and bounds validation for scores and assessment data.
4. Improve error handling to safely reject malformed requests with appropriate status codes.
5. Implement rate limiting to prevent assessment spam and abuse.
6. Add answer verification and basic tamper-detection checks to preserve assessment integrity.
7. Log suspicious or invalid assessment attempts for monitoring.
8. Add comprehensive test cases covering invalid inputs, malformed JSON, boundary values, and abuse scenarios.

Could you please assign this issue to me under gssoc-2026?

Thank you!