Don't trust any input from users

[purnendudash]

Here the file_get_contents used directly without any sanitisation.

moodle-availability_examus2/api.php

Line 62 in 3658279

$requestbody = file_get_contents('php://input');

Kindly use proper cleanup before using any such values. Here is the reference doc - https://moodledev.io/general/development/policies/security#dont-trust-any-input-from-users

[evsoldatkin]

Data can not be optained by optional_param or required_param functions, because it goes in a raw body format according to intergation specifications of the external service.
Data is recieved only from the integration server after JWT signature verification and cleaned after by using json_decode.
The same can be found in a core intergation with shibboleth in auth\shibboleth\login.php