From f184a9c74ae9c83a367069a3a72f66cf76167111 Mon Sep 17 00:00:00 2001 From: Jah-yee <166608075+Jah-yee@users.noreply.github.com> Date: Tue, 6 Oct 2026 11:29:14 +0800 Subject: [PATCH] fix(server): validate title field in POST /api/projects Adds the same validation that PATCH already has: title must be a string, 1-80 characters after trimming, or omitted. Without this, POST /api/projects accepted titles of any length, only-spaces titles, or numeric titles, leading to malformed entries in the sidebar and command palette. Fixes #35. --- app/server/src/app.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/app/server/src/app.ts b/app/server/src/app.ts index 94b0a8c..9f7e1f2 100644 --- a/app/server/src/app.ts +++ b/app/server/src/app.ts @@ -168,7 +168,8 @@ export function createApp(d: Deps): Hono { app.post("/api/projects", async c => { const b = await body<{ repo?: string; folder?: string; title?: string; slug?: string }>(c) - const p = b.repo ? await d.lib.addRepo(b.repo, { title: b.title, slug: b.slug }) : b.folder ? d.lib.addFolder(b.folder, { title: b.title, slug: b.slug }) : null + if (b.title !== undefined && (typeof b.title !== "string" || !b.title.trim() || b.title.length > 80)) throw new AppError(400, "a title is 1 to 80 characters") + const p = b.repo ? await d.lib.addRepo(b.repo, { title: b.title?.trim(), slug: b.slug }) : b.folder ? d.lib.addFolder(b.folder, { title: b.title?.trim(), slug: b.slug }) : null if (!p) throw new AppError(400, "give a GitHub repo (owner/name or URL) or a local folder") // a repo this login can read but not push to: say so now, not at the first save let warning: string | null = null