chrisp/brackt
1
1
Fork 0
Code Issues 42 Pull requests Projects Releases Packages Wiki Activity Actions 1

fix: validate action filter URL param against known enum values

Browse source 
The action filter on the audit log route was cast directly from the URL
search param to AuditAction without validation. An invalid value would
be passed into the Drizzle inArray() call, potentially throwing a
PostgreSQL enum type error. Now validates against the actual enum values
before using the filter.

https://claude.ai/code/session_01NdiwK2fbtKhAD3XuD58fTm
This commit is contained in:
Claude 2026-04-13 22:30:20 +00:00
parent 1d84cd6949
commit 0836dfdaa0
No known key found for this signature in database
1 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
app/routes/leagues/$leagueId.audit-log.tsx
View file

@ -31,6 +31,9 @@ import { findCurrentSeasonWithSports } from "~/models/season";
import { findTeamsBySeasonId } from "~/models/team"; import { findTeamsBySeasonId } from "~/models/team";
import { getAuditLogForSeason, type AuditAction, type AuditLogEntry } from "~/models/audit-log"; import { getAuditLogForSeason, type AuditAction, type AuditLogEntry } from "~/models/audit-log";
import { AUDIT_ACTION_LABELS, formatAuditDetail } from "~/lib/audit-log-display"; import { AUDIT_ACTION_LABELS, formatAuditDetail } from "~/lib/audit-log-display";
import * as schema from "~/database/schema";
const VALID_AUDIT_ACTIONS = new Set<string>(schema.auditActionEnum.enumValues);
export function meta({ data }: Route.MetaArgs): Route.MetaDescriptors { export function meta({ data }: Route.MetaArgs): Route.MetaDescriptors {
return [{ title: `Audit Log — ${data?.league?.name ?? "League"} - Brackt` }]; return [{ title: `Audit Log — ${data?.league?.name ?? "League"} - Brackt` }];
@ -80,7 +83,9 @@ export async function loader(args: Route.LoaderArgs) {
const searchParams = new URL(request.url).searchParams; const searchParams = new URL(request.url).searchParams;
const page = Math.max(0, parseInt(searchParams.get("page") ?? "0", 10) || 0); const page = Math.max(0, parseInt(searchParams.get("page") ?? "0", 10) || 0);
const actionFilter = searchParams.get("action") as AuditAction | null; const rawAction = searchParams.get("action");
const actionFilter: AuditAction | null =
rawAction && VALID_AUDIT_ACTIONS.has(rawAction) ? (rawAction as AuditAction) : null;
const [auditLog, teams] = await Promise.all([ const [auditLog, teams] = await Promise.all([
getAuditLogForSeason(season.id, { getAuditLogForSeason(season.id, {