From fccd1c072c0f0a78b27250d6cfd5ae0fd7db1c6b Mon Sep 17 00:00:00 2001 From: cozmiccle Date: Fri, 23 Oct 2026 10:03:20 -0700 Subject: [PATCH] Validate short link login passwords with the password validator GET, PATCH and DELETE on /api/v2/short_link checked the password with the suffix validator, which only allows [a-zA-Z0-9-]{1,32}. Links created with a password containing other characters, or longer than 32 characters, could never be viewed, edited or deleted by their owner. Co-Authored-By: Claude Opus 5.5 --- src/routes/api/v2/short_link/+server.ts | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/src/routes/api/v2/short_link/+server.ts b/src/routes/api/v2/short_link/+server.ts index d3cc48e1..0f57470e 100644 --- a/src/routes/api/v2/short_link/+server.ts +++ b/src/routes/api/v2/short_link/+server.ts @@ -4,6 +4,7 @@ import type { RequestHandler } from './$types'; import { ShortLink } from './model'; import { shortLinkCreateValidator, + shortLinkPasswordValidator, shortLinkSuffixValidator, shortLinkUrlUpdateValidator, } from './validator'; @@ -43,7 +44,9 @@ export const POST: RequestHandler = async ({ request }) => { export const GET: RequestHandler = async ({ url }) => { try { const suffix = await shortLinkSuffixValidator.validate(url.searchParams.get('suffix')); - const password = await shortLinkSuffixValidator.validate(url.searchParams.get('password')); + const password = await shortLinkPasswordValidator + .required() + .validate(url.searchParams.get('password')); const found = await ShortLink.findOne({ suffix: suffix }).select('+hash'); if (!found) return error(404, { message: 'Short link not found' }); @@ -74,7 +77,9 @@ export const GET: RequestHandler = async ({ url }) => { export const PATCH: RequestHandler = async ({ request, url }) => { try { const suffix = await shortLinkSuffixValidator.validate(url.searchParams.get('suffix')); - const password = await shortLinkSuffixValidator.validate(url.searchParams.get('password')); + const password = await shortLinkPasswordValidator + .required() + .validate(url.searchParams.get('password')); const req = await request.json(); const validatedReq = await shortLinkUrlUpdateValidator.validate(req, { stripUnknown: true }); @@ -108,7 +113,9 @@ export const PATCH: RequestHandler = async ({ request, url }) => { export const DELETE: RequestHandler = async ({ url }) => { try { const suffix = await shortLinkSuffixValidator.validate(url.searchParams.get('suffix')); - const password = await shortLinkSuffixValidator.validate(url.searchParams.get('password')); + const password = await shortLinkPasswordValidator + .required() + .validate(url.searchParams.get('password')); const found = await ShortLink.findOne({ suffix: suffix }).select('+hash'); if (!found) return error(404, { message: 'Short link not found' });