mirror of
https://github.com/Sendouc/sendou.ink.git
synced 2026-05-06 13:19:31 -05:00
f216423089
A crawler hitting /builds/:slug?limit=48%27 (URL-encoded single quote, likely an SQL injection probe) was triggering SQLITE_MISMATCH errors server-side. The loader was calling Number() on the raw string, which returned NaN, and then forwarding NaN as the LIMIT bind parameter on the underlying Kysely query. No injection was possible (params are bound), but the bad value only failed at the DB boundary. Parse the param through a zod schema that coerces to a positive int, falls back to the default batch size on any invalid input, and clamps to the page max. |
||
|---|---|---|
| .. | ||
| components | ||
| core | ||
| loaders | ||
| routes | ||
| BuildRepository.server.ts | ||
| builds-constants.ts | ||
| builds-schemas.server.ts | ||
| builds-types.ts | ||