From ae7c0030892ece2bb82b07840ac44b1f80056701 Mon Sep 17 00:00:00 2001 From: arkon Date: Wed, 21 Jan 2026 16:20:56 +0100 Subject: [PATCH] fix: add input validation for /input and /resize API endpoints - Add validation for input parameter in /input endpoint - Add validation for cols/rows as positive integers in /resize endpoint - Use standardized error responses with ApiErrorCode Co-Authored-By: Claude Opus 4.5 --- src/web/server.ts | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/src/web/server.ts b/src/web/server.ts index 58eec2ff..3c15aa82 100644 --- a/src/web/server.ts +++ b/src/web/server.ts @@ -25,6 +25,8 @@ import { generateClaudeMd } from '../templates/claude-md.js'; import { v4 as uuidv4 } from 'uuid'; import { getErrorMessage, + ApiErrorCode, + createErrorResponse, type CreateSessionRequest, type RunPromptRequest, type SessionInputRequest, @@ -411,10 +413,14 @@ export class WebServer extends EventEmitter { const session = this.sessions.get(id); if (!session) { - return { success: false, error: 'Session not found' }; + return createErrorResponse(ApiErrorCode.NOT_FOUND, 'Session not found'); } - session.write(input); + if (input === undefined || input === null) { + return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Input is required'); + } + + session.write(String(input)); return { success: true }; }); @@ -425,7 +431,11 @@ export class WebServer extends EventEmitter { const session = this.sessions.get(id); if (!session) { - return { success: false, error: 'Session not found' }; + return createErrorResponse(ApiErrorCode.NOT_FOUND, 'Session not found'); + } + + if (!Number.isInteger(cols) || !Number.isInteger(rows) || cols < 1 || rows < 1) { + return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'cols and rows must be positive integers'); } session.resize(cols, rows);