From c6f06627f26b608df5b1afdf1d15cef83ea09de0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Yusuf=20=C4=B0pek?= Date: Fri, 10 Apr 2026 21:50:13 +0300 Subject: [PATCH] feat(progress): add validation for duration to ensure it is a non-negative finite number --- .../videos/[videoId]/versions/[versionId]/route.ts | 4 ++++ app/api/watch/[videoId]/progress/route.ts | 6 +++++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/app/api/projects/[projectId]/videos/[videoId]/versions/[versionId]/route.ts b/app/api/projects/[projectId]/videos/[videoId]/versions/[versionId]/route.ts index 478913d..8b1864e 100644 --- a/app/api/projects/[projectId]/videos/[videoId]/versions/[versionId]/route.ts +++ b/app/api/projects/[projectId]/videos/[videoId]/versions/[versionId]/route.ts @@ -55,6 +55,10 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) { const body = await request.json(); const { duration, versionLabel, isActive } = body; + if (duration !== undefined && (typeof duration !== 'number' || !isFinite(duration) || duration < 0)) { + return apiErrors.badRequest('Invalid duration value'); + } + const updateData: Record = {}; if (duration !== undefined) updateData.duration = duration; if (versionLabel !== undefined) updateData.versionLabel = versionLabel?.trim() || null; diff --git a/app/api/watch/[videoId]/progress/route.ts b/app/api/watch/[videoId]/progress/route.ts index 92fb79f..c24e5c1 100644 --- a/app/api/watch/[videoId]/progress/route.ts +++ b/app/api/watch/[videoId]/progress/route.ts @@ -85,10 +85,14 @@ export async function POST(request: NextRequest, { params }: RouteParams) { const body = await request.json(); const { progress, duration, versionId } = body; - if (typeof progress !== 'number' || progress < 0) { + if (typeof progress !== 'number' || !isFinite(progress) || progress < 0) { return apiErrors.badRequest('Invalid progress value'); } + if (duration !== undefined && (typeof duration !== 'number' || !isFinite(duration) || duration < 0)) { + return apiErrors.badRequest('Invalid duration value'); + } + if (versionId !== undefined && typeof versionId !== 'string') { return apiErrors.badRequest('Invalid versionId'); }