From 32f06ecc56dad180de98e3d4e555e765d3b9cf2e Mon Sep 17 00:00:00 2001 From: zaragoza444 Date: Mon, 29 Jun 2026 01:00:15 -0700 Subject: [PATCH] fix: validate numeric office id on money-supply route Avoid TypeScript express param regex; return 404 for non-numeric ids like public. Co-authored-by: Cursor --- .../settlement-middleware/src/api/routes/settlement.ts | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/services/settlement-middleware/src/api/routes/settlement.ts b/services/settlement-middleware/src/api/routes/settlement.ts index c8c69aa..0a6c243 100644 --- a/services/settlement-middleware/src/api/routes/settlement.ts +++ b/services/settlement-middleware/src/api/routes/settlement.ts @@ -101,10 +101,14 @@ export function createSettlementRouter(): Router { } }); - router.get('/money-supply/:officeIdParam(\\d+)', async (req, res) => { + router.get('/money-supply/:officeIdParam', async (req, res) => { if (!requireApiKey(req, res)) return; + const requested = parseInt(req.params.officeIdParam, 10); + if (!Number.isFinite(requested)) { + res.status(404).json({ error: 'Not found' }); + return; + } try { - const requested = parseInt(req.params.officeIdParam, 10); res.json(await getMoneySupply(settlementOfficeId(requested))); } catch (e) { res.status(400).json({ error: e instanceof Error ? e.message : String(e) });