From f3b131a02c28bc3db0dcc5008fec7226e053e312 Mon Sep 17 00:00:00 2001
From: suhaniiz <suhanishrivastava75@gmail.com>
Date: Fri, 7 Aug 2026 17:45:17 +0530
Subject: [PATCH] fix: validate ObjectId format in reviewFlashcard and
 deleteFlashcard (#1197)

---
 backend/controllers/flashcardController.js | 24 ++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/backend/controllers/flashcardController.js b/backend/controllers/flashcardController.js
index 01975ee0..6ba4f74c 100644
--- a/backend/controllers/flashcardController.js
+++ b/backend/controllers/flashcardController.js
@@ -1,3 +1,4 @@
+const mongoose = require("mongoose");
 const Flashcard = require("../models/Flashcard");
 
 /**
@@ -145,6 +146,14 @@ const reviewFlashcard = async (req, res) => {
     const { rating } = req.body;
     const userId = req.user._id;
 
+    // Validate ObjectId format before querying database
+    if (!mongoose.Types.ObjectId.isValid(id)) {
+      return res.status(400).json({
+        success: false,
+        message: "Invalid flashcard ID format",
+      });
+    }
+
     if (!rating) {
       return res.status(400).json({
         success: false,
@@ -201,6 +210,14 @@ const deleteFlashcard = async (req, res) => {
     const { id } = req.params;
     const userId = req.user._id;
 
+    // Validate ObjectId format before querying database
+    if (!mongoose.Types.ObjectId.isValid(id)) {
+      return res.status(400).json({
+        success: false,
+        message: "Invalid flashcard ID format",
+      });
+    }
+
     const flashcard = await Flashcard.findOneAndDelete({ _id: id, userId });
     if (!flashcard) {
       return res.status(404).json({
@@ -242,7 +259,10 @@ const getFlashcardStats = async (req, res) => {
       interval: { $gte: 21 },
     });
 
-    const startOfDay = new Date(now.setHours(0, 0, 0, 0));
+    // Fix: Clone 'now' before setting hours to avoid in-place mutation of 'now'
+    const startOfDay = new Date(now);
+    startOfDay.setHours(0, 0, 0, 0);
+
     const reviewedToday = await Flashcard.countDocuments({
       userId,
       lastReviewedAt: { $gte: startOfDay },
@@ -273,4 +293,4 @@ module.exports = {
   deleteFlashcard,
   getFlashcardStats,
   calculateSM2,
-};
+};
\ No newline at end of file