Reliability: Missing input validation across API routes

[OneStepAt4time]

Summary

Multiple API routes accept request bodies without Zod schema validation, relying on manual type checking that is inconsistent and incomplete.

Details

• File: src/server.ts

Routes missing Zod validation

• POST /v1/auth/keys — name and rateLimit extracted without schema. Negative rateLimit accepted.
• POST /v1/sessions/:id/send — text checked for truthiness but not typed
• POST /v1/sessions/:id/command — command not schema-validated
• POST /v1/sessions/:id/bash — same as command
• POST /v1/sessions/:id/screenshot — fullPage, width, height passed through without validation
• POST /v1/sessions/:id/hooks/permission — no body validation at all
• POST /v1/sessions/:id/hooks/stop — no body validation at all
• POST /v1/sessions/batch — manual array/type checking instead of Zod
• POST /v1/pipelines — manual validation instead of Zod

Other validation gaps

• ws-terminal.ts:182-206 — WebSocket resize accepts unbounded cols/rows values
• mcp-server.ts:39-48 — workDir uses substring matching via includes() instead of exact/prefix
• mcp-server.ts:51-53 — session IDs not validated as UUID format before URL construction
• config.ts:161-168 — parseInt on env vars never checked for NaN
• server.ts:1185-1186 — zombieReapDelayMs accepts NaN from env vars
• cli.ts:186-189 — port not validated before setting env var

No batch session limit

POST /v1/sessions/batch accepts an unbounded array. An authenticated user could pass 10,000 specs, exhausting system resources.

Suggested Fix

1. Define Zod schemas for all request bodies, use `safeParse` consistently
2. Clamp viewport dimensions: `cols = Math.max(1, Math.min(cols, 1000))`
3. Use exact UUID regex for session IDs in MCP server
4. Add `isNaN`/`isFinite` checks after all `parseInt` calls on config
5. Cap batch size at 50