From d302875e25ef64d745f66c6bc03065c5395766ae Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Yusuf=20=C4=B0pek?= Date: Sat, 14 Feb 2026 16:22:07 +0300 Subject: [PATCH] fix(api): add type validation to prevent type confusion attacks in video PATCH Validates that title and description are strings before calling .trim() method to prevent type confusion attacks in the video update endpoint. --- app/api/projects/[projectId]/videos/[videoId]/route.ts | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/app/api/projects/[projectId]/videos/[videoId]/route.ts b/app/api/projects/[projectId]/videos/[videoId]/route.ts index 0d616b3..44f57ed 100644 --- a/app/api/projects/[projectId]/videos/[videoId]/route.ts +++ b/app/api/projects/[projectId]/videos/[videoId]/route.ts @@ -126,10 +126,11 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) { const body = await request.json(); const { title, description, position } = body; - + + // Validate types before using string methods to prevent type confusion attacks const updateData: Record = {}; - if (title !== undefined) updateData.title = title.trim(); - if (description !== undefined) updateData.description = description?.trim() || null; + if (typeof title === 'string') updateData.title = title.trim(); + if (typeof description === 'string') updateData.description = description.trim() || null; if (position !== undefined) updateData.position = position; const updatedVideo = await db.video.update({