SecurityHigh

Missing Input Validation

src/api/profile.ts:18

What's going on

The profile update handler trusts the request body without checking types, lengths, or allowed fields, so malformed or oversized payloads are processed as-is.

Why it matters

Unvalidated input is the root cause behind most injection, overflow, and data-integrity bugs. Validating at the boundary stops the class of bug before it starts.

src/api/profile.ts:18

Recommended Fix

Replace the inline query with a parameterized statement and validate the id before it ever reaches the database. A regression test is generated alongside the patch.

Before

1router.patch("/profile", async (req: Request, res: Response) => {2  const body = req.body; // unvalidated3  const updated = await updateProfile(req.userId, body);4  res.json(updated);5});

After

1const profileSchema = z.object({2  displayName: z.string().trim().min(1).max(40).optional(),3  bio: z.string().max(280).optional(),4  avatarUrl: z.string().url().optional(),5}).strict();6 7router.patch("/profile", async (req: Request, res: Response) => {8  const parsed = profileSchema.safeParse(req.body);9  if (!parsed.success) {10    return res.status(400).json({ error: parsed.error.flatten() });11  }12  const updated = await updateProfile(req.userId, parsed.data);13  res.json(updated);14});

Uploaddone
Analyzedone
Finddone
Explainactive
Fixupcoming
Testupcoming
Verifyupcoming