z

bangumi · May 27, 2024 · d4b6dd2 · d4b6dd2
1 parent 4fda70b
commit d4b6dd2
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/web/handler/subject/browse.go b/web/handler/subject/browse.go
@@ -109,13 +109,19 @@ func parseBrowseQuery(c echo.Context) (*subject.BrowseFilter, error) {
 		if year, err := gstr.ParseInt32(yearStr); err != nil {
 			return nil, res.BadRequest(err.Error())
 		} else {
+			if year < 1900 || year > 3000 {
+				return nil, res.BadRequest("invalid year: " + yearStr)
+			}
 			filter.Year = null.Int32{Value: year, Set: true}
 		}
 	}
 	if monthStr := c.QueryParam("month"); monthStr != "" {
 		if month, err := gstr.ParseInt8(monthStr); err != nil {
 			return nil, res.BadRequest(err.Error())
 		} else {
+			if month < 1 || month > 12 {
+				return nil, res.BadRequest("invalid month: " + monthStr)
+			}
 			filter.Month = null.Int8{Value: month, Set: true}
 		}
 	}