From db1c594fae6b9261189e1570d51968bfe1677649 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Yusuf=20=C4=B0pek?= Date: Fri, 10 Apr 2026 21:51:18 +0300 Subject: [PATCH] feat(progress): add validation for progress and duration to ensure they are non-negative finite numbers within a reasonable range --- app/api/watch/[videoId]/progress/route.ts | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/app/api/watch/[videoId]/progress/route.ts b/app/api/watch/[videoId]/progress/route.ts index c24e5c1..182cd4d 100644 --- a/app/api/watch/[videoId]/progress/route.ts +++ b/app/api/watch/[videoId]/progress/route.ts @@ -85,11 +85,13 @@ export async function POST(request: NextRequest, { params }: RouteParams) { const body = await request.json(); const { progress, duration, versionId } = body; - if (typeof progress !== 'number' || !isFinite(progress) || progress < 0) { + const MAX_VIDEO_SECONDS = 86_400; // 24 hours — reasonable upper bound for any video + + if (typeof progress !== 'number' || !isFinite(progress) || progress < 0 || progress > MAX_VIDEO_SECONDS) { return apiErrors.badRequest('Invalid progress value'); } - if (duration !== undefined && (typeof duration !== 'number' || !isFinite(duration) || duration < 0)) { + if (duration !== undefined && (typeof duration !== 'number' || !isFinite(duration) || duration < 0 || duration > MAX_VIDEO_SECONDS)) { return apiErrors.badRequest('Invalid duration value'); }