From b86697b6db262cded2276f185842cd16b6587981 Mon Sep 17 00:00:00 2001
From: Justin Lin <wancat@wancat.cc>
Date: Sat, 26 Apr 2025 18:10:33 +0800
Subject: [PATCH] fix: validate command input in newCommand controller

---
 server/src/api/controllers/commandController.ts | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/server/src/api/controllers/commandController.ts b/server/src/api/controllers/commandController.ts
index 6313742..0b0e54a 100644
--- a/server/src/api/controllers/commandController.ts
+++ b/server/src/api/controllers/commandController.ts
@@ -8,7 +8,12 @@ import { questManager } from '../../models/quest'
 import { CLIFileExistenceChecker } from '../../containers/cli'
 
 export const newCommand = asyncHandler(async (req: Request, res: Response) => {
-  const command = commandSchema.parse(req.body)
+  const body = commandSchema.safeParse(req.body)
+  if (!body.success) {
+    res.status(400).json({ message: 'Invalid command', errors: body.error })
+    return
+  }
+  const command = body.data
 
   const { sessionId } = req.user as any
   const session = await Session.findById(sessionId)
@@ -40,10 +45,10 @@ export const newCommand = asyncHandler(async (req: Request, res: Response) => {
     new CLIFileExistenceChecker(session.containerId!)
   )
 
-  const event = await gameSession.runCommand(command)
+  const event = await gameSession.runCommand(body)
 
   const c = new Command({
-    ...command,
+    ...body,
     session: sessionId,
     stage: event,
   })