SECURITY: Missing input validation on lat/lng in items API #6

New issue

Closed

opened 2026-05-09 00:27:15 +00:00 by Mark · 1 comment

Mark commented

2026-05-09 00:27:15 +00:00

Owner

Description

The items API endpoints (POST /api/trips/[tripId]/items and PATCH /api/items/[itemId]) accept lat and lng parameters without server-side validation before inserting into the database. The domain layer has a GeoLocation value object with validation, but the API routes don't use it.

The Issue

In src/app/api/trips/[tripId]/items/route.ts (lines 71-88):

const body = await req.json();
const [item] = await db.insert(itineraryItems).values({
  // ...
  lat: body.lat,       // No validation — could be NaN, Infinity, or out of range
  lng: body.lng,       // Same issue
  // ...
}).returning();

The same issue exists in the PATCH endpoint at src/app/api/items/[itemId]/route.ts (lines 60-61).

Impact

Invalid coordinates could be stored in the database (NaN, out-of-range values)
The Mapbox map component could crash or behave unexpectedly when trying to render invalid coordinates
Malicious or malformed requests could corrupt map data

Fix

Add validation before insertion:

// Validate coordinates if provided
if (body.lat !== undefined && body.lng !== undefined) {
  if (!GeoLocation.isValid(Number(body.lat), Number(body.lng))) {
    return NextResponse.json({ error: "Invalid coordinates" }, { status: 400 });
  }
}

Or reuse the existing GeoLocation.create() / GeoLocation.isValid() from @/domain/value-objects/geo-location.

## Description The items API endpoints (`POST /api/trips/[tripId]/items` and `PATCH /api/items/[itemId]`) accept `lat` and `lng` parameters without server-side validation before inserting into the database. The domain layer has a `GeoLocation` value object with validation, but the API routes don't use it. ## The Issue In `src/app/api/trips/[tripId]/items/route.ts` (lines 71-88): ```typescript const body = await req.json(); const [item] = await db.insert(itineraryItems).values({ // ... lat: body.lat, // No validation — could be NaN, Infinity, or out of range lng: body.lng, // Same issue // ... }).returning(); ``` The same issue exists in the PATCH endpoint at `src/app/api/items/[itemId]/route.ts` (lines 60-61). ## Impact - Invalid coordinates could be stored in the database (NaN, out-of-range values) - The Mapbox map component could crash or behave unexpectedly when trying to render invalid coordinates - Malicious or malformed requests could corrupt map data ## Fix Add validation before insertion: ```typescript // Validate coordinates if provided if (body.lat !== undefined && body.lng !== undefined) { if (!GeoLocation.isValid(Number(body.lat), Number(body.lng))) { return NextResponse.json({ error: "Invalid coordinates" }, { status: 400 }); } } ``` Or reuse the existing `GeoLocation.create()` / `GeoLocation.isValid()` from `@/domain/value-objects/geo-location`.

Mark added the

security/medium

label

2026-07-27 19:19:31 +00:00

Mark referenced this issue from a commit

2026-08-12 03:46:36 +00:00

fix(api): validate lat/lng and item type, owner-only member/share authz, timezone-aware shared day plans, sanitize share secrets

Mark commented

2026-08-12 03:47:10 +00:00

Author

Owner

Fixed in commit a5510ba: items POST/PATCH accepted unvalidated lat/lng. Now range-checked via GeoLocation (-90..90 / -180..180), item type enum-validated, title required; also fixed day-filter off-by-one (lte -> lt).

Fixed in commit a5510ba: items POST/PATCH accepted unvalidated lat/lng. Now range-checked via GeoLocation (-90..90 / -180..180), item type enum-validated, title required; also fixed day-filter off-by-one (lte -> lt).

Mark closed this issue

2026-08-12 03:47:10 +00:00

Mark referenced this issue

2026-09-14 15:55:02 +00:00

[Security] HIGH: 5 critical/high dependency vulns #11