yusufipek/OpenFrame
1
0
Fork 0
mirror of https://github.com/yusufipk/OpenFrame.git synced 2026-09-11 17:46:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(api): add type validation to prevent type confusion attacks in video PATCH

Browse Source 
Validates that title and description are strings before calling .trim() method to prevent type confusion attacks in the video update endpoint.
This commit is contained in:
Yusuf İpek
2026-02-14 16:22:07 +03:00
parent 1c7ee70815
commit d302875e25
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/api/projects/[projectId]/videos/[videoId]/route.ts
+4 -3
View File
@@ -126,10 +126,11 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
const body = await request.json();
const { title, description, position } = body;
// Validate types before using string methods to prevent type confusion attacks
const updateData: Record<string, unknown> = {};
if (title !== undefined) updateData.title = title.trim();
if (description !== undefined) updateData.description = description?.trim() || null;
if (typeof title === 'string') updateData.title = title.trim();
if (typeof description === 'string') updateData.description = description.trim() || null;
if (position !== undefined) updateData.position = position;
const updatedVideo = await db.video.update({