From 79d8b742e3475b5dee72b073144e51e3fb4b2693 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Yusuf=20=C4=B0pek?= Date: Fri, 10 Apr 2026 21:49:15 +0300 Subject: [PATCH] feat(videos): add validation for position to ensure it is a non-negative integer --- app/api/projects/[projectId]/videos/[videoId]/route.ts | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/app/api/projects/[projectId]/videos/[videoId]/route.ts b/app/api/projects/[projectId]/videos/[videoId]/route.ts index 239f753..73d9241 100644 --- a/app/api/projects/[projectId]/videos/[videoId]/route.ts +++ b/app/api/projects/[projectId]/videos/[videoId]/route.ts @@ -173,6 +173,13 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) { const { title, description, position } = body; // Validate types before using string methods to prevent type confusion attacks + if ( + position !== undefined && + (typeof position !== 'number' || !Number.isInteger(position) || position < 0) + ) { + return apiErrors.badRequest('position must be a non-negative integer'); + } + const updateData: Record = {}; if (typeof title === 'string') updateData.title = title.trim(); if (typeof description === 'string') updateData.description = description.trim() || null;