From b1045a30c93bce47a3f7689722cbb5a036b4aa14 Mon Sep 17 00:00:00 2001 From: vedant7007 Date: Mon, 1 Jun 2026 00:32:38 +0530 Subject: [PATCH] fix: enforce content moderation on doubt and reply edits to prevent abuse bypass (#474) --- src/app/api/doubts/action/[id]/route.ts | 9 +++++++++ src/app/api/replies/action/[id]/route.ts | 9 +++++++++ 2 files changed, 18 insertions(+) diff --git a/src/app/api/doubts/action/[id]/route.ts b/src/app/api/doubts/action/[id]/route.ts index eb4996c0..55d8c28b 100644 --- a/src/app/api/doubts/action/[id]/route.ts +++ b/src/app/api/doubts/action/[id]/route.ts @@ -3,6 +3,7 @@ import { doubtTagsTable, doubtsTable, likesTable, classroomsTable, repliesTable, import { and, eq, isNull, sql } from "drizzle-orm"; import { NextResponse } from "next/server"; import { currentUser } from "@clerk/nextjs/server"; +import { moderateContent, handleModerationViolation } from "@/lib/moderation"; import { parseAndValidateRequest } from "@/lib/validations/validate"; import { updateDoubtActionSchema } from "@/lib/validations/doubt"; import { DOUBT_STATUS, DoubtStatus, isValidDoubtStatus } from "@/lib/doubtStatus"; @@ -166,6 +167,14 @@ export async function PATCH(req: Request, { params }: { params: Promise<{ id: st return NextResponse.json({ error: "Only the owner can edit their doubt" }, { status: 403 }); } + if (content) { + const moderation = await moderateContent(content); + const violationError = await handleModerationViolation(email!, content, moderation); + if (violationError) { + return NextResponse.json({ error: violationError }, { status: 400 }); + } + } + const [updated] = await db.update(doubtsTable) .set({ content: content || null, diff --git a/src/app/api/replies/action/[id]/route.ts b/src/app/api/replies/action/[id]/route.ts index 14239a06..6a2565b3 100644 --- a/src/app/api/replies/action/[id]/route.ts +++ b/src/app/api/replies/action/[id]/route.ts @@ -4,6 +4,7 @@ import { eq } from "drizzle-orm"; import { NextRequest, NextResponse } from "next/server"; import { currentUser } from "@clerk/nextjs/server"; import { checkUserBlock } from "@/lib/auth-utils"; +import { moderateContent, handleModerationViolation } from "@/lib/moderation"; import { parseAndValidateRequest } from "@/lib/validations/validate"; import { updateReplyActionSchema } from "@/lib/validations/reply"; @@ -46,6 +47,14 @@ export async function PATCH(req: NextRequest, { params }: { params: Promise<{ id return NextResponse.json({ error: "Forbidden: not allowed to edit this reply" }, { status: 403 }); } + if (content) { + const moderation = await moderateContent(content); + const violationError = await handleModerationViolation(email, content, moderation); + if (violationError) { + return NextResponse.json({ error: violationError }, { status: 400 }); + } + } + const updateData: { content?: string | null; imageUrl?: string | null } = {}; if (content !== undefined) updateData.content = content; if (imageUrl !== undefined) updateData.imageUrl = imageUrl;