From 10363388c03cfb2798febac79fddad15c0c082ef Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 11 Jan 2026 06:57:25 +0000
Subject: [PATCH] Add input validation for ping values in /api/push endpoint

Co-authored-by: CommanderStorm <26258709+CommanderStorm@users.noreply.github.com>
---
 server/routers/api-router.js | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/server/routers/api-router.js b/server/routers/api-router.js
index 8f6d09248..742cd577d 100644
--- a/server/routers/api-router.js
+++ b/server/routers/api-router.js
@@ -52,6 +52,13 @@ router.all("/api/push/:pushToken", async (request, response) => {
         let statusString = request.query.status || "up";
         const statusFromParam = statusString === "up" ? UP : DOWN;
 
+        // Validate ping value - max 1 billion ms (~11.5 days)
+        // Fits safely in both BIGINT and FLOAT(20,2)
+        const MAX_PING_MS = 1000000000;
+        if (ping !== null && (ping < 0 || ping > MAX_PING_MS)) {
+            throw new Error(`Invalid ping value. Must be between 0 and ${MAX_PING_MS} ms.`);
+        }
+
         let monitor = await R.findOne("monitor", " push_token = ? AND active = 1 ", [pushToken]);
 
         if (!monitor) {