Merge pull request #4348 from KadirFiratFTW/fix/4347-information-disclosure-returned-in-response

fix: Information Disclosure: Internal Prisma & Database Errors Return…

src/app/api/boards/[boardId]/route.ts

@@ -36,8 +36,8 @@ export async function POST(request: Request, { params }: { params: Promise<{ boa
       ])
       .or(z.literal('open'))
       .optional(),
-    name: z.string().optional(),
-    description: z.string().optional(),
+    name: z.string().max(200).optional(),
+    description: z.string().max(500).optional(),
     parameters: z.object({}).passthrough().optional(),
   });
 

src/app/api/dashboard/route.ts

@@ -21,8 +21,8 @@ export async function GET(request: Request) {
 
 export async function POST(request: Request) {
   const schema = z.object({
-    name: z.string().optional(),
-    description: z.string().optional(),
+    name: z.string().max(200).optional(),
+    description: z.string().max(500).optional(),
     parameters: z.object({}).passthrough().optional(),
   });
 

src/app/api/links/[linkId]/route.ts

@@ -24,9 +24,9 @@ export async function GET(request: Request, { params }: { params: Promise<{ link
 
 export async function POST(request: Request, { params }: { params: Promise<{ linkId: string }> }) {
   const schema = z.object({
-    name: z.string().optional(),
-    url: z.string().optional(),
-    slug: z.string().min(8).optional(),
+    name: z.string().max(100).optional(),
+    url: z.string().max(500).optional(),
+    slug: z.string().min(8).max(100).optional(),
   });
 
   const { auth, body, error } = await parseRequest(request, schema);

src/app/api/pixels/[pixelId]/route.ts

@@ -24,8 +24,8 @@ export async function GET(request: Request, { params }: { params: Promise<{ pixe
 
 export async function POST(request: Request, { params }: { params: Promise<{ pixelId: string }> }) {
   const schema = z.object({
-    name: z.string().optional(),
-    slug: z.string().min(8).optional(),
+    name: z.string().max(100).optional(),
+    slug: z.string().min(8).max(100).optional(),
   });
 
   const { auth, body, error } = await parseRequest(request, schema);

src/app/api/send/route.ts

@@ -44,17 +44,17 @@ const schema = z.object({
       language: z.string().max(35).optional(),
       referrer: urlOrPathParam.optional(),
       screen: z.string().max(11).optional(),
-      title: z.string().optional(),
+      title: z.string().max(500).optional(),
       url: urlOrPathParam.optional(),
       name: safeStringParam(50).optional(),
       tag: safeStringParam(50).optional(),
       ip: z.string().optional(),
       userAgent: z.string().optional(),
       timestamp: z.coerce.number().int().optional(),
-      id: z.string().optional(),
-      browser: z.string().optional(),
-      os: z.string().optional(),
-      device: z.string().optional(),
+      id: z.string().max(50).optional(),
+      browser: z.string().max(20).optional(),
+      os: z.string().max(20).optional(),
+      device: z.string().max(20).optional(),
       lcp: z.number().nonnegative().max(60000).optional(),
       inp: z.number().nonnegative().max(60000).optional(),
       cls: z.number().nonnegative().max(100).optional(),

src/app/api/websites/[websiteId]/route.ts

@@ -41,8 +41,8 @@ export async function POST(
   { params }: { params: Promise<{ websiteId: string }> },
 ) {
   const schema = z.object({
-    name: z.string().optional(),
-    domain: z.string().optional(),
+    name: z.string().max(100).optional(),
+    domain: z.string().max(500).optional(),
     shareId: z.string().max(50).nullable().optional(),
     replayConfig: z
       .object({