fix: add input validation and rate limiting to /api/compare endpoint#2045
Conversation
|
@vipul674 is attempting to deploy a commit to the jhasourav07's projects Team on Vercel. A member of the Team first needs to authorize it. |
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Adds support for a new /api/compare route and centralizes query parameter validation for the compare endpoint.
Changes:
- Adds
/api/compare/:path*to the middleware matcher config. - Introduces
compareParamsSchema(Zod) for validatinguser1/user2GitHub usernames (including “not the same user” constraint). - Updates
app/api/compare/route.tsto use schema-based validation and return structured validation errors.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| middleware.ts | Adds the compare API path to middleware matching config. |
| lib/validations.ts | Adds a Zod schema for compare endpoint query parameters and constraints. |
| app/api/compare/route.ts | Switches to schema-based validation and returns validation details on bad requests. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| user1: z | ||
| .string({ error: 'Missing "user1" parameter' }) |
| user2: z | ||
| .string({ error: 'Missing "user2" parameter' }) |
| if (!parseResult.success) { | ||
| return NextResponse.json( | ||
| { error: 'Both user1 and user2 query parameters are required.' }, | ||
| { error: 'Invalid parameters', details: parseResult.error.flatten() }, |
|
@vipul674 look for conflcts |
|
@Aamod007 No conflicts, the PR is mergeable. All code checks (Format, Lint, Typecheck, Test, Production Build) are passing. The remaining CI failures are Vercel authorization (needs maintainer action) and the GitHub API rate limits. |
work on these
|
|
@Aamod007 As you have requested, i have ensured that the checks pass, now only the vercel requires your authorization. Please review and let me know for any changes. |
|
@vipul674 work on pipeline fix |
|
Please pull the latest changes and resolve the conflicts so we can review it! git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-leaseOnce resolved, the |
1 similar comment
|
Please pull the latest changes and resolve the conflicts so we can review it! git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-leaseOnce resolved, the |
github-actions
Bot
added
needs-rebase
|
Please pull the latest changes and resolve the conflicts so we can review it! git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-leaseOnce resolved, the |
17 similar comments
|
Please pull the latest changes and resolve the conflicts so we can review it! git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-leaseOnce resolved, the |
|
Please pull the latest changes and resolve the conflicts so we can review it! git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-leaseOnce resolved, the |
|
Please pull the latest changes and resolve the conflicts so we can review it! git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-leaseOnce resolved, the |
|
Please pull the latest changes and resolve the conflicts so we can review it! git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-leaseOnce resolved, the |
|
Please pull the latest changes and resolve the conflicts so we can review it! git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-leaseOnce resolved, the |
|
Please pull the latest changes and resolve the conflicts so we can review it! git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-leaseOnce resolved, the |
|
Please pull the latest changes and resolve the conflicts so we can review it! git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-leaseOnce resolved, the |
|
Please pull the latest changes and resolve the conflicts so we can review it! git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-leaseOnce resolved, the |
|
Please pull the latest changes and resolve the conflicts so we can review it! git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-leaseOnce resolved, the |
|
Please pull the latest changes and resolve the conflicts so we can review it! git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-leaseOnce resolved, the |
|
Please pull the latest changes and resolve the conflicts so we can review it! git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-leaseOnce resolved, the |
|
Please pull the latest changes and resolve the conflicts so we can review it! git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-leaseOnce resolved, the |
|
Please pull the latest changes and resolve the conflicts so we can review it! git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-leaseOnce resolved, the |
|
Please pull the latest changes and resolve the conflicts so we can review it! git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-leaseOnce resolved, the |
|
Please pull the latest changes and resolve the conflicts so we can review it! git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-leaseOnce resolved, the |
|
Please pull the latest changes and resolve the conflicts so we can review it! git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-leaseOnce resolved, the |
|
Please pull the latest changes and resolve the conflicts so we can review it! git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-leaseOnce resolved, the |
|
Please pull the latest changes and resolve the conflicts so we can review it! git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-leaseOnce resolved, the |
4 similar comments
|
Please pull the latest changes and resolve the conflicts so we can review it! git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-leaseOnce resolved, the |
|
Please pull the latest changes and resolve the conflicts so we can review it! git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-leaseOnce resolved, the |
|
Please pull the latest changes and resolve the conflicts so we can review it! git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-leaseOnce resolved, the |
|
Please pull the latest changes and resolve the conflicts so we can review it! git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-leaseOnce resolved, the |
vipul674
force-pushed
the
fix/compare-api-validation
branch
from
3138d8d to
55183be
Compare
|
Please pull the latest changes and resolve the conflicts so we can review it! git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-leaseOnce resolved, the |
1 similar comment
|
Please pull the latest changes and resolve the conflicts so we can review it! git fetch origin
git rebase origin/main
# resolve any conflicts, then:
git push --force-with-leaseOnce resolved, the |
vipul674
force-pushed
the
fix/compare-api-validation
branch
from
55183be to
c178060
Compare
github-actions
Bot
added
status:blocked
|
🚨 Hey @vipul674, the CI Pipeline is failing on this PR and it has been marked as Please fix the issues before this can be reviewed. Here's how: 1. Run checks locally before pushing: npm run format:check # Check Prettier formatting
npm run lint # Run ESLint
npm run typecheck # TypeScript type check
npm run test # Run unit tests (Vitest)
npm run build # Verify production build passes2. Auto-fix common issues: npm run format # Auto-fix formatting with Prettier
npm run lint -- --fix # Auto-fix lint errors where possible3. Check the full failure log here: Once you push a fix and the CI passes, the |
|
🚨 Hey @vipul674, the CI Pipeline is failing on this PR and it has been marked as Please fix the issues before this can be reviewed. Here's how: 1. Run checks locally before pushing: npm run format:check # Check Prettier formatting
npm run lint # Run ESLint
npm run typecheck # TypeScript type check
npm run test # Run unit tests (Vitest)
npm run build # Verify production build passes2. Auto-fix common issues: npm run format # Auto-fix formatting with Prettier
npm run lint -- --fix # Auto-fix lint errors where possible3. Check the full failure log here: Once you push a fix and the CI passes, the |
github-actions
Bot
removed
the
status:blocked
|
@Aamod007 Now the checks pass, Only the Vercel deployment authorization is blocking, please review and let me know for any other change |
|
@JhaSourav07 The changes have been approved by @Aamod007 . Please review |
Aamod007
added
GSSoC 2026
mentor:Aamod007
type:refactor
JhaSourav07
added
the
gssoc:approved
|
🎉 Congratulations @vipul674! Your PR has been successfully merged. 🚀 Thank you for contributing to CommitPulse. Your work helps us build a better tool for the community.
Keep building! 💻✨ |
Description
Fixes a security vulnerability in
/api/comparewhere raw, unvalidateduser1anduser2query parameters were passed directly togetFullDashboardData()with no input validation and no IP-based rate limiting.Every other API route (
/api/streak,/api/github,/api/stats,/api/og) validates usernames via Zod schema and is covered by the middleware rate limiter./api/comparewas the sole exception — each request triggers 8 unauthenticated GitHub API calls (4 per user) with zero protection.Changes
lib/validations.ts— AddedcompareParamsSchemausing the existingGITHUB_USERNAME_REGEX, with a.refine()to reject self-comparisonapp/api/compare/route.ts— Replaced manual null checks with ZodsafeParse(), matching the pattern used by all other API routesmiddleware.ts— Added/api/compare/:path*to the rate-limiter matcherDifficulty & Label Request
level:beginnerlabel if this assessment is appropriate, so this contribution is scored correctly under GSSoC 2026 guidelines.gssoc:approvedlabel after review so this PR earns its base GSSoC points. Thank you!Type
Testing & Verification
GITHUB_USERNAME_REGEX/api/compare/api/github,/api/streak,/api/statsroutesNote on Copilot Review Comments
z.string({ error: ... })is invalid — this is incorrect for Zod v4 (^4.4.3). Theerroroption is valid and matches the existing pattern atlib/validations.ts:281(githubParamsSchema).error.flatten()— this matches the exact pattern used by every other API route (/api/github/route.ts:31,/api/streak/route.ts,/api/stats/route.ts). Consistency with the existing codebase takes precedence.GSSoC 2026 Compliance & Transparency