From d3b385b37a1598f2b706717194a999383096319f Mon Sep 17 00:00:00 2001 From: aiirvizionz Date: Wed, 29 Jul 2026 17:37:49 -0600 Subject: [PATCH] fix(auth): validate verify sms phone strings --- src/app/api/auth/verify-sms/route.js | 4 ++++ src/app/api/auth/verify-sms/route.test.js | 15 +++++++++++++++ 2 files changed, 19 insertions(+) diff --git a/src/app/api/auth/verify-sms/route.js b/src/app/api/auth/verify-sms/route.js index abe732b..bb30c7f 100644 --- a/src/app/api/auth/verify-sms/route.js +++ b/src/app/api/auth/verify-sms/route.js @@ -60,6 +60,10 @@ export async function POST(request, { params } = {}) { return NextResponse.json({ error: 'Invalid request format' }, { status: 400 }); } + if (phoneNumber !== null && phoneNumber !== undefined && typeof phoneNumber !== 'string') { + return NextResponse.json({ error: 'Phone number must be a string' }, { status: 400 }); + } + logger.info('SMS verification request received', { phoneNumber: phoneNumber ? `${phoneNumber.substring(0, 3)}***${phoneNumber.substring(phoneNumber.length - 2)}` : null, hasCode: !!verificationCode, diff --git a/src/app/api/auth/verify-sms/route.test.js b/src/app/api/auth/verify-sms/route.test.js index 50c3cd2..1eace22 100644 --- a/src/app/api/auth/verify-sms/route.test.js +++ b/src/app/api/auth/verify-sms/route.test.js @@ -90,6 +90,21 @@ describe('verify-sms session phone binding', () => { expect(mocks.getUser).not.toHaveBeenCalled(); }); + it('rejects non-string phone numbers before session validation', async () => { + const { POST } = await import('./route.js'); + const res = await POST(sessionRequest({ + useSession: true, + phoneNumber: 15559999999, + username: 'alice' + })); + const body = await res.json(); + + expect(res.status).toBe(400); + expect(body.error).toBe('Phone number must be a string'); + expect(mocks.serverClient).not.toHaveBeenCalled(); + expect(mocks.getUser).not.toHaveBeenCalled(); + }); + it('rejects anonymous / phoneless sessions', async () => { mocks.getUser.mockResolvedValue({ data: { user: { id: 'anon', phone: null } },