From 3e023bf2f7ae15bc420f545b148bba3f25924977 Mon Sep 17 00:00:00 2001
From: tyl-droid <Jeffriestyler11@gmail.com>
Date: Fri, 11 Sep 2026 08:34:36 +0100
Subject: [PATCH] [match] strictly parse player ids

---
 apps/match/src/match.app.ts | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/apps/match/src/match.app.ts b/apps/match/src/match.app.ts
index 487d3270..d20959cf 100644
--- a/apps/match/src/match.app.ts
+++ b/apps/match/src/match.app.ts
@@ -1704,8 +1704,9 @@ const app = new Hono<App>()
 			responses: { 200: json(InstanceIdResponse, 'The instance id, or 0') },
 		}),
 		async (c) => {
-			const playerId = Number.parseInt(c.req.query('id') ?? '', 10)
-			if (!Number.isInteger(playerId)) return c.json(NO_INSTANCE)
+			const rawPlayerId = (c.req.query('id') ?? '').trim()
+			const playerId = /^\d+$/.test(rawPlayerId) ? Number(rawPlayerId) : Number.NaN
+			if (!Number.isSafeInteger(playerId) || playerId <= 0) return c.json(NO_INSTANCE)
 
 			const presence = await getPresence<RoomInstance>(c.env.DB, playerId)
 			return c.json(presence?.roomInstance?.roomInstanceId ?? NO_INSTANCE)