fix: validate analytics filter ids

backend/src/routes/analytics.test.ts

@@ -0,0 +1,12 @@
+import assert from 'node:assert/strict';
+import { parseOptionalId } from './analytics';
+
+assert.equal(parseOptionalId(undefined, 0), undefined);
+assert.equal(parseOptionalId('0', 0), 0);
+assert.equal(parseOptionalId('1', 1), 1);
+assert.equal(parseOptionalId('0', 1), null);
+assert.equal(parseOptionalId('abc', 0), null);
+assert.equal(parseOptionalId('1.5', 0), null);
+assert.equal(parseOptionalId(['1'], 0), null);
+
+console.log('analytics query validation: OK');

backend/src/routes/analytics.ts

@@ -5,6 +5,30 @@ import type { Granularity } from '@family-budget/shared';
 
 const router = Router();
 
+export function parseOptionalId(value: unknown, minimum: number): number | null | undefined {
+  if (value === undefined) return undefined;
+  if (typeof value !== 'string' || !/^\d+$/.test(value)) return null;
+
+  const id = Number(value);
+  return Number.isSafeInteger(id) && id >= minimum ? id : null;
+}
+
+router.use((req, res, next) => {
+  const accountId = parseOptionalId(req.query.accountId, 1);
+  if (accountId === null) {
+    res.status(400).json({ error: 'BAD_REQUEST', message: 'accountId must be a positive integer' });
+    return;
+  }
+
+  const categoryId = parseOptionalId(req.query.categoryId, 0);
+  if (categoryId === null) {
+    res.status(400).json({ error: 'BAD_REQUEST', message: 'categoryId must be a non-negative integer' });
+    return;
+  }
+
+  next();
+});
+
 router.get(
   '/summary',
   asyncHandler(async (req, res) => {