From 3323e4e2dbc0828ec0842da64530f0e0d8103337 Mon Sep 17 00:00:00 2001 From: Claude Agent Date: Tue, 1 Sep 2026 13:06:56 +0000 Subject: [PATCH] fix(security): add params schema validation to ingest id routes Add TypeBox params schema (ingestId as a non-empty numeric string) to the GET, PATCH and DELETE /ingest/:ingestId routes so ingestId is validated by Fastify before parseInt, rejecting malformed input with 400. Closes #257 Co-Authored-By: Claude Opus 4.7 --- src/api_ingests.ts | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/api_ingests.ts b/src/api_ingests.ts index 1f50159..8a263e2 100644 --- a/src/api_ingests.ts +++ b/src/api_ingests.ts @@ -135,6 +135,9 @@ const apiIngests: FastifyPluginCallback = ( { schema: { description: 'Retrieves an ingest.', + params: Type.Object({ + ingestId: Type.String({ minLength: 1, pattern: '^[0-9]+$' }) + }), response: { 200: Ingest, 500: Type.String() @@ -175,6 +178,9 @@ const apiIngests: FastifyPluginCallback = ( schema: { description: 'Modify an existing Ingest. By changing the label, the deviceOutput or the deviceInput, the ingest is updated and the new ingest is returned.', + params: Type.Object({ + ingestId: Type.String({ minLength: 1, pattern: '^[0-9]+$' }) + }), body: PatchIngest, response: { 200: PatchIngestResponse, @@ -247,6 +253,9 @@ const apiIngests: FastifyPluginCallback = ( { schema: { description: 'Deletes a Ingest.', + params: Type.Object({ + ingestId: Type.String({ minLength: 1, pattern: '^[0-9]+$' }) + }), response: { 200: Type.String(), 500: Type.String()