Skip to content

fix(frontend): Validate relationship_category values from URL params #121

Description

@enko

Problem

In friendListFilter.ts (previously in friends.ts), parseSearchParams uses an unsafe as cast for relationship_category URL params:

filters.relationship_category = relationshipCategory.split(',') as (
  | 'family'
  | 'professional'
  | 'social'
)[];

A malformed URL like ?relationship_category=invalid will pass the cast silently and send an invalid enum value downstream to the API.

Proposal

Add a runtime filter to only keep valid values:

const validCategories = ['family', 'professional', 'social'] as const;
filters.relationship_category = relationshipCategory
  .split(',')
  .filter((v): v is 'family' | 'professional' | 'social' => 
    validCategories.includes(v as any)
  );

Affected files

  • apps/frontend/src/lib/stores/friendListFilter.ts

Spotted during review of #120.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions