From 400f48dacdaac56951e3e5d514c2c6acd2cb9f91 Mon Sep 17 00:00:00 2001 From: Ayush7614 Date: Sun, 6 Sep 2026 01:15:24 +0530 Subject: [PATCH] fix(server): reject whitespace-only and non-string slug and title in POST /sandboxed --- server/src/components/sandboxed-routes.ts | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/server/src/components/sandboxed-routes.ts b/server/src/components/sandboxed-routes.ts index 8e4ae2263..659f87ece 100644 --- a/server/src/components/sandboxed-routes.ts +++ b/server/src/components/sandboxed-routes.ts @@ -63,14 +63,19 @@ export function createSandboxedRoutes( sampleArguments?: Record; } | null; - if (!body?.slug || !body.title) { + if ( + typeof body?.slug !== "string" || + !body.slug.trim() || + typeof body?.title !== "string" || + !body.title.trim() + ) { return context.json({ error: "A name and a title are required." }, 400); } try { const component = await store.save({ - slug: body.slug, - title: body.title, + slug: body.slug.trim(), + title: body.title.trim(), description: body.description ?? "", html: body.html ?? "", css: body.css ?? "",