From ed4cdd64fbbc2024fecd7224ae2dc201a3bfd833 Mon Sep 17 00:00:00 2001 From: tyl-droid Date: Fri, 11 Sep 2026 08:54:50 +0100 Subject: [PATCH] [lists] strictly parse list type queries --- apps/lists/src/lists.app.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/apps/lists/src/lists.app.ts b/apps/lists/src/lists.app.ts index 4e0874d0..469f181d 100644 --- a/apps/lists/src/lists.app.ts +++ b/apps/lists/src/lists.app.ts @@ -773,7 +773,8 @@ const app = new Hono() // Echoed, but only when it fits the byte the client reads it back into — anything // outside 0–255 can't round-trip, so a nonsense `?type=` gets the default instead of a // number that would break the response on the way in. - const type = Number.parseInt(c.req.query('type') ?? '', 10) + const rawType = (c.req.query('type') ?? '').trim() + const type = /^-?\d+$/.test(rawType) ? Number(rawType) : Number.NaN const echoed = type >= 0 && type <= MAX_LIST_ENTITY_TYPE ? type : DEFAULT_ALGORITHMIC_LIST_TYPE