yusufipek/OpenFrame
1
0
Fork 0
mirror of https://github.com/yusufipk/OpenFrame.git synced 2026-09-11 17:46:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(comments): add validation for guest email length and format in POST request

Browse Source
This commit is contained in:
Yusuf İpek
2026-04-10 21:43:16 +03:00
parent 1be0e6d6fa
commit 72bdc05422
1 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/api/versions/[versionId]/comments/route.ts
+11
View File
@@ -261,6 +261,17 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
if (guestName !== undefined && guestName !== null && String(guestName).length > 100) { if (guestName !== undefined && guestName !== null && String(guestName).length > 100) {
return apiErrors.badRequest('Guest name must be 100 characters or fewer'); return apiErrors.badRequest('Guest name must be 100 characters or fewer');
} }
if (guestEmail !== undefined && guestEmail !== null) {
const emailStr = String(guestEmail);
if (emailStr.length > 254) {
return apiErrors.badRequest('Guest email must be 254 characters or fewer');
}
// RFC 5321 / HTML5 email pattern — simple but sufficient for a stored-value guard
const emailRe = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
if (!emailRe.test(emailStr)) {
return apiErrors.badRequest('Guest email must be a valid email address');
}
}
// Validate annotation data structure to prevent prototype pollution and stored XSS. // Validate annotation data structure to prevent prototype pollution and stored XSS.
// Reject anything that is not a well-formed array of AnnotationStroke objects. // Reject anything that is not a well-formed array of AnnotationStroke objects.