Prevent invalid post IDs from crashing rest-api

.github/workflows/build.yml

@@ -43,7 +43,7 @@ jobs:
           type=ref,event=pr
           type=semver,pattern={{version}}
           type=semver,pattern={{major}}.{{minor}}
-          type=sha,prefix={{branch}}-
+          type=sha
 
     - name: Build and push Docker image
       id: build

modules/decode-post-id.js

@@ -0,0 +1,17 @@
+const decodePostId = function decodePostId (hashids, value) {
+    let decoded;
+
+    try {
+        decoded = hashids.decode(value);
+    } catch (decodeError) {
+        return null;
+    }
+
+    if (decoded.length !== 1 || !Number.isSafeInteger(decoded[0])) {
+        return null;
+    }
+
+    return decoded[0];
+};
+
+module.exports = decodePostId;

package.json

@@ -3,9 +3,9 @@
   "version": "1.0.0",
   "main": "server.js",
   "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1",
+    "test": "node --test test/**/*.test.js",
     "start": "node --env-file-if-exists=.env server.js",
-    "pretest": "eslint **/*.js",
+    "pretest": "eslint modules/decode-post-id.js test/**/*.js",
     "dev": "node --watch --env-file-if-exists=.env server.js"
   },
   "keywords": [],

server.js

@@ -10,6 +10,7 @@ const { Op } = require('sequelize');
 const { LRUCache } = require( 'lru-cache' );
 
 const models = require( './models' );
+const decodePostId = require( './modules/decode-post-id' );
 
 const LISTEN_PORT = process.env.PORT || 3000;
 const JSON_INDENTATION = 4;
@@ -683,11 +684,20 @@ server.get(
                 }
             );
         } else {
+            const decodedId = decodePostId( hashids, request.params.id );
+
+            if ( decodedId === null ) {
+                response.status( NOT_FOUND_STATUS_CODE );
+                response.end();
+
+                return;
+            }
+
             query.where = Object.assign(
                 {},
                 query.where,
                 {
-                    id: hashids.decode( request.params.id ),
+                    id: decodedId,
                 }
             );
         }

test/unit/decode-post-id.test.js

@@ -0,0 +1,28 @@
+/* eslint-disable no-magic-numbers */
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const Hashids = require('hashids/cjs');
+
+const decodePostId = require('../../modules/decode-post-id');
+
+const hashids = new Hashids('', 8, 'abcdefghijklmnopqrstuvwxyz');
+
+test('decodes a valid post hash to one numeric database ID', () => {
+    const encoded = hashids.encode(12345);
+
+    assert.equal(decodePostId(hashids, encoded), 12345);
+});
+
+test('returns null when Hashids rejects malformed input', () => {
+    assert.equal(decodePostId(hashids, 'invalid!'), null);
+});
+
+test('returns null when input decodes to no IDs', () => {
+    assert.equal(decodePostId(hashids, 'aaaaaaaa'), null);
+});
+
+test('returns null when input decodes to multiple IDs', () => {
+    const encoded = hashids.encode(123, 456);
+
+    assert.equal(decodePostId(hashids, encoded), null);
+});