Skip to content

fix: code quality and safety improvements #1163

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
saurabhhhcodes wants to merge 1 commit into from
Closed

fix: code quality and safety improvements #1163

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/app/(routes)/rooms/[id]/members/page.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@ function RoleBadge({ role, isOwner }: { role: string; isOwner: boolean }) {

function formatJoinedAt(joinedAt: string): string {
const date = new Date(joinedAt);
if (isNaN(date.getTime())) return '';
if (Number.isNaN(date.getTime())) return '';
return date.toLocaleDateString(undefined, { year: 'numeric', month: 'short', day: 'numeric' });
}

Expand Down
4 changes: 2 additions & 2 deletions src/app/api/classrooms/[id]/export/route.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,14 +47,14 @@ export async function GET(

if (from) {
const fromDate = new Date(from);
if (!isNaN(fromDate.getTime())) {
if (!Number.isNaN(fromDate.getTime())) {

@codeant-ai codeant-ai Bot Aug 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: The invalid-date guard silently skips the filter, so requests such as from=not-a-date or to=not-a-date export the full teacher-visible dataset instead of rejecting the malformed restriction. Return a 400 response for invalid date parameters so a caller cannot unintentionally receive data outside the requested range. [api mismatch]

Severity Level: Major ⚠️ 
- ⚠️ Teacher export silently ignores malformed date restrictions.
- ⚠️ Exported dataset may exceed the caller’s requested range.
- ❌ Invalid client requests receive data instead of 400.

Fix in Cursor Fix in VSCode Claude

(Use Cmd/Ctrl + Click for best experience)

Prompt for AI Agent 🤖 
This is a comment left during a code review.

**Path:** src/app/api/classrooms/[id]/export/route.ts
**Line:** 50:50
**Comment:**
	*Api Mismatch: The invalid-date guard silently skips the filter, so requests such as `from=not-a-date` or `to=not-a-date` export the full teacher-visible dataset instead of rejecting the malformed restriction. Return a 400 response for invalid date parameters so a caller cannot unintentionally receive data outside the requested range.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
👍 | 👎

conditions.push(gte(doubtsTable.createdAt, fromDate));
}
}

if (to) {
const toDate = new Date(to);
if (!isNaN(toDate.getTime())) {
if (!Number.isNaN(toDate.getTime())) {
conditions.push(lte(doubtsTable.createdAt, toDate));
}
}
Expand Down
2 changes: 1 addition & 1 deletion src/app/api/confusion/route.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@ export async function PATCH(req: Request) {
}

const targetId = Number(alertIdString);
if (isNaN(targetId)) {
if (Number.isNaN(targetId)) {

@codeant-ai codeant-ai Bot Aug 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggestion: Number accepts values outside the database ID contract, including exponent notation, Infinity, and negative numbers, while this guard rejects only NaN. For example, id=1e2 is treated as alert ID 100 and may acknowledge that alert, while id=Infinity can reach the integer query and produce a server error instead of a deterministic 400. Validate the original parameter as a positive safe integer. [type error]

Severity Level: Major ⚠️ 
- ⚠️ Confusion-alert PATCH accepts non-canonical identifiers.
- ⚠️ Invalid `Infinity` input can produce a server error.
- ⚠️ Exponent input can acknowledge an unintended existing alert.

Fix in Cursor Fix in VSCode Claude

(Use Cmd/Ctrl + Click for best experience)

Prompt for AI Agent 🤖 
This is a comment left during a code review.

**Path:** src/app/api/confusion/route.ts
**Line:** 59:59
**Comment:**
	*Type Error: `Number` accepts values outside the database ID contract, including exponent notation, `Infinity`, and negative numbers, while this guard rejects only NaN. For example, `id=1e2` is treated as alert ID 100 and may acknowledge that alert, while `id=Infinity` can reach the integer query and produce a server error instead of a deterministic 400. Validate the original parameter as a positive safe integer.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
👍 | 👎

return new NextResponse("Invalid alert id", { status: 400 });
}

Expand Down
2 changes: 1 addition & 1 deletion src/app/api/doubts/[id]/route.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ export async function GET(
const { id } = await params;
const doubtId = parseInt(id, 10);

if (isNaN(doubtId)) {
if (Number.isNaN(doubtId)) {
return NextResponse.json({ error: "Invalid doubt ID" }, { status: 400 });
}

Expand Down
4 changes: 2 additions & 2 deletions src/app/api/replies/action/[id]/route.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ export async function PATCH(req: NextRequest, { params }: { params: Promise<{ id
const { id } = await params;
const parsedReplyId = parseInt(id);

if (isNaN(parsedReplyId)) {
if (Number.isNaN(parsedReplyId)) {
return NextResponse.json({ error: "Invalid reply ID" }, { status: 400 });
}

Expand Down Expand Up @@ -121,7 +121,7 @@ export async function DELETE(req: NextRequest, { params }: { params: Promise<{ i
const { id } = await params;
const replyId = parseInt(id);

if (isNaN(replyId)) {
if (Number.isNaN(replyId)) {
return NextResponse.json({ error: "Invalid reply ID" }, { status: 400 });
}

Expand Down
Loading