From aba76ea907e691ea8654b5ed82ed3ad0f8c1608a Mon Sep 17 00:00:00 2001 From: RissRIce Date: Wed, 12 Aug 2026 20:43:11 -0600 Subject: [PATCH 1/2] test(settings): reproduce malformed retention JSON --- .../disappearing-messages/route.test.js | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/src/app/api/settings/disappearing-messages/route.test.js b/src/app/api/settings/disappearing-messages/route.test.js index e73273b..593182f 100644 --- a/src/app/api/settings/disappearing-messages/route.test.js +++ b/src/app/api/settings/disappearing-messages/route.test.js @@ -142,4 +142,24 @@ describe('settings disappearing messages authentication', () => { expect(mocks.from).not.toHaveBeenCalled(); expect(mocks.updateEq).not.toHaveBeenCalled(); }); + + it('rejects malformed JSON before updating settings', async () => { + const { PUT } = await import('./route.js'); + const malformed = new Request('https://qrypt.chat/api/settings/disappearing-messages', { + method: 'PUT', + headers: { + authorization: 'Bearer valid-token', + 'content-type': 'application/json' + }, + body: '{"default_message_retention_days":' + }); + + const response = await PUT(malformed); + const body = await response.json(); + + expect(response.status).toBe(400); + expect(body.error).toBe('Invalid JSON body'); + expect(mocks.from).not.toHaveBeenCalled(); + expect(mocks.updateEq).not.toHaveBeenCalled(); + }); }); From 2adfc25502e87abd877fd3b1620417c4bad035d4 Mon Sep 17 00:00:00 2001 From: RissRIce Date: Wed, 12 Aug 2026 20:46:18 -0600 Subject: [PATCH 2/2] fix(settings): reject malformed retention JSON --- src/app/api/settings/disappearing-messages/route.js | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/src/app/api/settings/disappearing-messages/route.js b/src/app/api/settings/disappearing-messages/route.js index b8e6e43..5a22626 100644 --- a/src/app/api/settings/disappearing-messages/route.js +++ b/src/app/api/settings/disappearing-messages/route.js @@ -75,7 +75,14 @@ export async function PUT(request) { return NextResponse.json({ error: 'Invalid token' }, { status: 401 }); } - const { default_message_retention_days } = await request.json(); + let body; + try { + body = await request.json(); + } catch { + return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 }); + } + + const { default_message_retention_days } = body; // Validate input if (