Description
In the /api/analytics/views endpoint, the page query parameter is parsed into an integer and used to calculate skip for pagination. However, the value is not validated. If a client sends a negative number or a non-numeric string (which parses to NaN), the calculated skip value will be negative or NaN. Passing these values to the Prisma query causes a validation error and crashes the request.
Source Code Location
File: apps/backend/src/routes/analytics.ts
Proposed Fix
Sanitize and validate the page parameter to ensure it is a positive integer before performing database queries.
Description
In the
/api/analytics/viewsendpoint, thepagequery parameter is parsed into an integer and used to calculateskipfor pagination. However, the value is not validated. If a client sends a negative number or a non-numeric string (which parses toNaN), the calculatedskipvalue will be negative orNaN. Passing these values to the Prisma query causes a validation error and crashes the request.Source Code Location
File:
apps/backend/src/routes/analytics.tsProposed Fix
Sanitize and validate the
pageparameter to ensure it is a positive integer before performing database queries.