From 35ff50f02176b154be54159ec496232adf9d1078 Mon Sep 17 00:00:00 2001 From: Claude Agent Date: Tue, 1 Sep 2026 13:10:54 +0000 Subject: [PATCH] fix(security): validate WHIP/WHEP OPTIONS path params with TypeBox schema Co-Authored-By: Claude Opus 4.7 --- src/api_whep.ts | 4 ++++ src/api_whip.ts | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/src/api_whep.ts b/src/api_whep.ts index 0057d98..adf4fe0 100644 --- a/src/api_whep.ts +++ b/src/api_whep.ts @@ -314,6 +314,10 @@ export const apiWhep: FastifyPluginCallback = ( { schema: { description: 'CORS preflight and WHEP discovery endpoint', + params: Type.Object({ + productionId: Type.String({ minLength: 1, maxLength: 200 }), + lineId: Type.String({ minLength: 1, maxLength: 200 }) + }), response: { 200: Type.String({ description: 'OK' }) } diff --git a/src/api_whip.ts b/src/api_whip.ts index 52d82ed..0e918f0 100644 --- a/src/api_whip.ts +++ b/src/api_whip.ts @@ -315,6 +315,10 @@ export const apiWhip: FastifyPluginCallback = ( { schema: { description: 'CORS preflight and WHIP discovery endpoint', + params: Type.Object({ + productionId: Type.String({ minLength: 1, maxLength: 200 }), + lineId: Type.String({ minLength: 1, maxLength: 200 }) + }), response: { 200: Type.String({ description: 'OK' }) }