UUID path params not validated — every /:id route returns 500 with PG error on bad input #102

New issue

Closed

opened 2026-05-26 18:18:08 -04:00 by zgaetano · 1 comment

zgaetano commented

2026-05-26 18:18:08 -04:00

Owner

Fixed in 04ce096. New validateUuid middleware in middleware/errors.js. Every router with /:id (assets, recorders, projects, bins, jobs, schedules, sequences) now installs router.param('id', validateUuid('id')), returning a clean 400 instead of bouncing into Postgres with a 22P02.

Fixed in 04ce096. New `validateUuid` middleware in `middleware/errors.js`. Every router with `/:id` (assets, recorders, projects, bins, jobs, schedules, sequences) now installs `router.param('id', validateUuid('id'))`, returning a clean 400 instead of bouncing into Postgres with a 22P02.

~~zgaetano referenced this issue 2026-05-26 18:22:49 -04:00~~

Tracker: 2026-05-26 audit session — 27 bugs logged (#100-#127) #128

zgaetano commented

2026-05-26 19:31:13 -04:00

Author

Owner

Fix Plan — #102 UUID path params not validated → 500 on bad input

Root cause: No /:id, /:assetId, /:jobId, /:projectId route validates UUID format before PG query. PG throws 22P02, error handler leaks message → 500.

Fix — drop-in middleware (src/middleware/validate.js):

const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;

export function validateUUID(req, res, next) {
  for (const key of ["id", "assetId", "jobId", "projectId"]) {
    if (req.params[key] && !UUID_RE.test(req.params[key]))
      return res.status(400).json({ error: `Invalid ${key} format` });
  }
  next();
}

Apply globally in src/index.js:

app.use(validateUUID);

Files: src/middleware/validate.js (new), src/index.js
Effort: ~30min
**Priority: P0 — input validation

## Fix Plan — #102 UUID path params not validated → 500 on bad input **Root cause:** No `/:id`, `/:assetId`, `/:jobId`, `/:projectId` route validates UUID format before PG query. PG throws `22P02`, error handler leaks message → 500. **Fix — drop-in middleware (`src/middleware/validate.js`):** ```js const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i; export function validateUUID(req, res, next) { for (const key of ["id", "assetId", "jobId", "projectId"]) { if (req.params[key] && !UUID_RE.test(req.params[key])) return res.status(400).json({ error: `Invalid ${key} format` }); } next(); } ``` Apply globally in `src/index.js`: ```js app.use(validateUUID); ``` **Files:** `src/middleware/validate.js` (new), `src/index.js` **Effort:** ~30min **Priority: P0 — input validation

zgaetano referenced this issue

2026-05-26 19:42:16 -04:00

Tracker: 2026-05-26 audit session — 27 bugs logged (#100-#127) #128

zgaetano referenced this issue from a commit

2026-05-26 22:06:25 -04:00

chore: 1.2 ship-prep sweep — close 38 issues

zgaetano closed this issue

2026-05-26 22:09:47 -04:00