From 96fe4db0998b2752aea3330edd3ca8110a36352a Mon Sep 17 00:00:00 2001
From: Ralksta <16941050+ralksta@users.noreply.github.com>
Date: Wed, 11 Mar 2026 23:32:22 +0100
Subject: [PATCH] security: validate auth input types and limit length to
 prevent DoS [#1]

Added type checking and length validation to the `slug` and `password` variables in the `app/api/auth/route.ts` file to prevent potential DoS attacks via excessively long strings passed to expensive crypto functions.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
---
 app/api/auth/route.ts | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/app/api/auth/route.ts b/app/api/auth/route.ts
index a177fee..c5a6b15 100644
--- a/app/api/auth/route.ts
+++ b/app/api/auth/route.ts
@@ -27,6 +27,16 @@ export async function POST(request: NextRequest) {
       return NextResponse.json({ error: 'Missing slug or password' }, { status: 400 });
     }
 
+    // 🛡️ SECURITY: Validate input types and limit length to prevent DoS attacks
+    // (e.g. from extremely long strings being passed to expensive crypto functions)
+    if (typeof slug !== 'string' || slug.length > 100) {
+      return NextResponse.json({ error: 'Invalid slug format or length' }, { status: 400 });
+    }
+
+    if (typeof password !== 'string' || password.length > 100) {
+      return NextResponse.json({ error: 'Invalid password format or length' }, { status: 400 });
+    }
+
     if (!isProtected(slug)) {
       return NextResponse.json({ error: 'Album is not password-protected' }, { status: 400 });
     }