Skip to content

fix: comprehensive validation and security fixes (issues #71, #74, #75, #72, #73, #35)#82

Open
anshul23102 wants to merge 1 commit into
AditthyaSS:mainfrom
anshul23102:fix/71-74-75-72-73-35-validation-fixes
Open

fix: comprehensive validation and security fixes (issues #71, #74, #75, #72, #73, #35)#82
anshul23102 wants to merge 1 commit into
AditthyaSS:mainfrom
anshul23102:fix/71-74-75-72-73-35-validation-fixes

Conversation

@anshul23102
Copy link
Copy Markdown
Contributor

@anshul23102 anshul23102 commented Jun 4, 2026

Summary

This PR implements comprehensive validation and security fixes across API endpoints to prevent database pollution, information leakage, and input validation bypass attacks.

Changes

GET /api/models/[slug] (fixes #75)

  • Added isVerified check after model fetch
  • Returns 404 for both non-existent and unverified models (prevents information leakage)

GET /api/models (fixes #74)

  • Removed duplicate offset/limit parsing that was overwriting validated values
  • Uses single source of truth for pagination parameters

POST /api/models (fixes #71, #73)

  • Added name length validation (1-200 characters)
  • Gated feed event creation on isVerified === true
  • Pending submissions no longer appear in public activity feed

POST /api/reviews (fixes #72, #35)

  • Added entityId existence check before accepting review submission
  • Enhanced comment validation with whitespace trimming
  • Prevents all-whitespace submissions to maintain data integrity

Test Plan

  • Verify GET /api/models/[slug] returns 404 for unverified models
  • Verify GET /api/models pagination uses validated offset/limit
  • Verify POST /api/models name length validation (rejects < 1 or > 200 chars)
  • Verify feed events only created for verified models
  • Verify POST /api/reviews rejects non-existent entityIds with 404
  • Verify comment field rejects all-whitespace submissions
  • Manual testing: attempt creating review for non-existent model (should fail)
  • Manual testing: submit name > 200 chars (should fail)

🤖 Generated with Claude Code

@anshul23102
fix(AditthyaSS#75, AditthyaSS#74, AditthyaSS#73, AditthyaSS#72, Aditt…
20785f3 
…hyaSS#71, AditthyaSS#35): comprehensive validation and security fixes

Implements fixes for 6 related validation and security issues:

AditthyaSS#75: Add isVerified check to GET /api/models/[slug]. Prevent returning
     unverified/pending model submissions to the public API. Returns 404
     to avoid leaking information about pending submissions.

AditthyaSS#74: Remove duplicate offset parameter parsing in GET /api/models that
     was overwriting validated offset/limit values with unsanitized ones.

AditthyaSS#73: Gate feed event creation on isVerified status. Only verified models
     should appear in the public activity feed. Pending submissions are
     excluded from feed to prevent leaking unreviewed content.

AditthyaSS#72: Add entityId existence validation in POST /api/reviews. Verify that
     the referenced model or tool actually exists before accepting review
     submission, preventing database pollution with orphaned reviews.

AditthyaSS#71: Add name length constraint validation to POST /api/models.
     Names must be 1-200 characters to prevent excessively long values
     that could break UI rendering or storage.

AditthyaSS#35: Enhance comment field validation in POST /api/reviews. Trim
     whitespace and prevent all-whitespace-only submissions. Prevents
     spam and ensures comment field integrity.

Signed-off-by: Anshul Jain <anshul23102@iiitd.ac.in>
@vercel
Copy link
Copy Markdown

vercel Bot commented Jun 4, 2026

@anshul23102 is attempting to deploy a commit to the aditthyass' projects Team on Vercel.

A member of the Team first needs to authorize it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment