From 4089d7464c820e29d724e764f7a5e176b1b674f4 Mon Sep 17 00:00:00 2001 From: bot-hermes Date: Wed, 29 Jul 2026 12:59:20 +0000 Subject: [PATCH] fix: use whitelist sort columns in domains route to fix TypeScript error --- apps/web/app/api/domains/route.ts | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/apps/web/app/api/domains/route.ts b/apps/web/app/api/domains/route.ts index 4bdb5ed..fcc9e59 100644 --- a/apps/web/app/api/domains/route.ts +++ b/apps/web/app/api/domains/route.ts @@ -25,12 +25,19 @@ export const GET = withAuth(async (request: NextRequest, _user) => { const sortParam = searchParams.get('sort') || 'sort_order'; const filter = searchParams.get('filter') || undefined; - // Build order by + // Build order by — whitelist safe column names const sortDir = sortParam.startsWith('-') ? 'desc' : 'asc'; const sortField = sortParam.replace(/^-/, ''); + const sortColumns: Record = { + name: domains.name, + slug: domains.slug, + sort_order: domains.sortOrder, + created_at: domains.createdAt, + updated_at: domains.updatedAt, + }; const orderBy = sortDir === 'asc' - ? asc(domains[sortField as keyof typeof domains] || domains.sortOrder) - : desc(domains[sortField as keyof typeof domains] || domains.sortOrder); + ? asc(sortColumns[sortField] || domains.sortOrder) + : desc(sortColumns[sortField] || domains.sortOrder); // Build where clause const conditions: any[] = [];