Skip to content

fix: add radix parameter to parseInt calls #1095

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
saurabhhhcodes wants to merge 1 commit into
base: main
Choose a base branch
from
+4 −4
Open

fix: add radix parameter to parseInt calls #1095

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/app/(routes)/dashboard/analytics/page.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ export default function AnalyticsDashboard() {
try {
const end = new Date();
const start = new Date();
start.setDate(end.getDate() - parseInt(dateRange));
start.setDate(end.getDate() - parseInt(dateRange, 10));

let url = `/api/teacher/analytics?startDate=${start.toISOString()}&endDate=${end.toISOString()}`;
if (selectedClassroom !== "all") {
Expand Down
4 changes: 2 additions & 2 deletions src/app/api/doubts/action/[id]/route.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ export async function PATCH(req: Request, { params }: { params: Promise<{ id: st
const email = user?.primaryEmailAddress?.emailAddress;

const { id } = await params;
const doubtId = parseInt(id);
const doubtId = parseInt(id, 10);

@codeant-ai codeant-ai Bot Jul 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: The identifier is parsed with parseInt, which accepts partial strings such as 12abc, negative values, and zero. A malformed path can therefore be interpreted as a different doubt ID instead of returning the invalid-ID response. Validate the entire value as a positive safe integer before querying the database. [api mismatch]

Severity Level: Major ⚠️ 
- ❌ Malformed PATCH paths can target unintended doubts.
- ⚠️ Invalid identifiers bypass the documented 400 response.
- ⚠️ Negative and zero identifiers reach authorization logic.

Fix in Cursor Fix in VSCode Claude

(Use Cmd/Ctrl + Click for best experience)

Prompt for AI Agent 🤖 
This is a comment left during a code review.

**Path:** src/app/api/doubts/action/[id]/route.ts
**Line:** 25:25
**Comment:**
	*Api Mismatch: The identifier is parsed with `parseInt`, which accepts partial strings such as `12abc`, negative values, and zero. A malformed path can therefore be interpreted as a different doubt ID instead of returning the invalid-ID response. Validate the entire value as a positive safe integer before querying the database.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
👍 | 👎


if (isNaN(doubtId)) {
return NextResponse.json({ error: "Invalid doubt ID" }, { status: 400 });
Expand Down Expand Up @@ -320,7 +320,7 @@ export async function DELETE(req: Request, { params }: { params: Promise<{ id: s
}

const { id } = await params;
const doubtId = parseInt(id);
const doubtId = parseInt(id, 10);

@codeant-ai codeant-ai Bot Jul 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: The DELETE handler passes NaN to the Drizzle integer comparison without checking it. Requests such as /api/doubts/action/not-a-number can therefore cause a database/query error and return 500 instead of the expected 400 invalid-ID response. Add the same isNaN or strict positive-integer validation used by PATCH before executing the query. [error handling]

Severity Level: Major ⚠️ 
- ❌ DELETE requests with malformed IDs can return HTTP 500.
- ⚠️ Invalid requests generate avoidable database errors.
- ⚠️ Clients cannot reliably distinguish malformed IDs from server failures.

Fix in Cursor Fix in VSCode Claude

(Use Cmd/Ctrl + Click for best experience)

Prompt for AI Agent 🤖 
This is a comment left during a code review.

**Path:** src/app/api/doubts/action/[id]/route.ts
**Line:** 323:323
**Comment:**
	*Error Handling: The DELETE handler passes `NaN` to the Drizzle integer comparison without checking it. Requests such as `/api/doubts/action/not-a-number` can therefore cause a database/query error and return 500 instead of the expected 400 invalid-ID response. Add the same `isNaN` or strict positive-integer validation used by PATCH before executing the query.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
👍 | 👎


const [doubt] = await db.select().from(doubtsTable).where(and(eq(doubtsTable.id, doubtId), isNull(doubtsTable.deletedAt))).limit(1);
if (!doubt) return NextResponse.json({ error: "Doubt not found" }, { status: 404 });
Expand Down
2 changes: 1 addition & 1 deletion src/app/api/doubts/route.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ export async function GET(req: Request) {
try {
const user = await currentUser();
const email = user?.primaryEmailAddress?.emailAddress ?? null;
const classroomId = classroomIdStr ? parseInt(classroomIdStr) : null;
const classroomId = classroomIdStr ? parseInt(classroomIdStr, 10) : null;

@codeant-ai codeant-ai Bot Jul 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: Using parseInt without validating the complete query parameter makes invalid values such as abc or 0 become a falsy classroom ID. The request then skips classroom authorization and falls through to the public-doubt query (classroomId IS NULL) instead of rejecting the malformed classroom filter. Use strict positive-integer parsing and return a 400 for invalid values. [incorrect condition logic]

Severity Level: Major ⚠️ 
- ⚠️ Malformed classroom filters silently change query scope.
- ⚠️ Classroom authorization is skipped for invalid values.
- ⚠️ Feed clients receive public results instead of validation errors.

Fix in Cursor Fix in VSCode Claude

(Use Cmd/Ctrl + Click for best experience)

Prompt for AI Agent 🤖 
This is a comment left during a code review.

**Path:** src/app/api/doubts/route.ts
**Line:** 58:58
**Comment:**
	*Incorrect Condition Logic: Using `parseInt` without validating the complete query parameter makes invalid values such as `abc` or `0` become a falsy classroom ID. The request then skips classroom authorization and falls through to the public-doubt query (`classroomId IS NULL`) instead of rejecting the malformed classroom filter. Use strict positive-integer parsing and return a 400 for invalid values.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
👍 | 👎


if (classroomId && !email) {
return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
Expand Down
Loading