Profile Editing & Asset Management

Unvalidated profile update endpoints are a direct path to CWE-20 (Improper Input Validation) and CWE-434 (Unrestricted File Upload), both flagged under OWASP A03. A bio field with no length limit lets attackers stuff multi-megabyte payloads into your database on every request. Usernames without character constraints enable injection into downstream rendering contexts. Unvalidated avatar uploads allow executable content to reach your storage bucket, creating stored XSS or server-side execution vectors.

Add Zod validation to your profile update handler in app/api/users/[id]/route.ts before touching the database. Enforce a 500-character bio cap, a strict alphanumeric-plus-dash username regex, and MIME-type allowlisting on any uploaded file.

// app/api/users/[id]/route.ts
import { z } from 'zod'

const UpdateProfileSchema = z.object({
  bio: z.string().max(500).optional(),
  username: z.string().regex(/^[a-zA-Z0-9_-]{3,20}$/).optional()
})

export async function PATCH(req: Request, { params }: { params: { id: string } }) {
  const body = await req.json()
  const parsed = UpdateProfileSchema.safeParse(body)
  if (!parsed.success) {
    return Response.json({ error: parsed.error.flatten() }, { status: 400 })
  }
  const updated = await db.user.update({
    where: { id: params.id },
    data: parsed.data
  })
  return Response.json(updated)
}