From 26d364d05ef419c77882a05e200fddebbaf59d14 Mon Sep 17 00:00:00 2001 From: Serhat Dolmaci Date: Mon, 29 Jun 2026 23:44:42 +0300 Subject: [PATCH] fix(validate): add input validation for upgradeId and userType The validate route was missing the safe path pattern check that install-deps and upgrade-config routes use. Add /^[a-zA-Z0-9_-]+$/ validation to prevent non-alphanumeric characters in path parameters. --- src/app/api/validate/route.ts | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/app/api/validate/route.ts b/src/app/api/validate/route.ts index 7a17e09..c3817e8 100644 --- a/src/app/api/validate/route.ts +++ b/src/app/api/validate/route.ts @@ -21,6 +21,15 @@ export async function POST(req: NextRequest) { ); } + // Validate inputs to prevent path traversal attacks + const safePathPattern = /^[a-zA-Z0-9_-]+$/; + if (!safePathPattern.test(upgradeId) || !safePathPattern.test(userType)) { + return NextResponse.json( + { message: 'Invalid parameters: upgradeId and userType must only contain alphanumeric characters, underscores, and hyphens' }, + { status: 400 } + ); + } + const trimmedUpgradeId = upgradeId.trim(); const trimmedUserType = userType.trim(); const normalizedNetwork = network.trim().toLowerCase();