Proxy module has no request validation — passes through malicious payloads to downstream services

[amaydixit11]

Description

The proxy module in src/proxy/ acts as a gateway between the Hub and downstream services (Campus-Marketplace, CCPS-Portal, etc.) but performs no input validation, sanitization, or rate limiting on forwarded requests.

If any downstream service has a vulnerability, the proxy provides no protective layer. Conversely, the proxy could be used to:

1. Forward overly large payloads causing memory exhaustion on backend services
2. Bypass rate limits on individual services (proxy has its own identity, so per-user rate limits don't apply)
3. Amplify attacks by fanning out a single request to multiple downstream services

Expected Behavior

• Request payload size limits
• Input validation on proxied requests
• Per-user rate limiting at the proxy level

Suggested Fix

• Add request body size limits (bodyLimit in Fastify)
• Implement a validation middleware that checks Content-Type and approximate payload size
• Add per-user rate limiting using the user identity extracted from auth

Affected Files

• src/proxy/proxy.service.ts
• src/proxy/proxy.module.ts