Rules Hub
Coding Rules Library
Rule priority, scope & exceptions
Use this to align rules with the senior-level structure (P0/P1/P2, scope, exceptions/tradeoffs).
Validate a route path param against its expected format before passing it to a lookup
Don't assume an ID-shaped route param (e.g. `:id`) is well-formed just because it matched the route — validate it against the format you actually expect (numeric, UUID, etc.) before passing it into a lookup, especially if that lookup's own parsing is more permissive than the route implies (e.g. silently treating a comma-separated string as a list).
Bad example
| 1 | router.get('/author/:id/articles', async (req, res) => { |
| 2 | const author = await AuthorRepository.byId(req.params.id); // byId -> byIds(id.split(',')) internally |
| 3 | ... |
| 4 | }); |
Explanation (EN)
`/author/1234,5678/articles` is accepted by the route and silently resolved to author 1234 by the lookup's own comma-splitting, returning a misleadingly successful response for what should be a 400.
Objašnjenje (HR)
`/author/1234,5678/articles` prihvaća ruta i tiho ga rješava kao autora 1234 zbog lookup funkcije koja interno dijeli po zarezu, vraćajući zavaravajuće uspješan odgovor umjesto 400 greške.
Good example
| 1 | router.get('/author/:id(\\d+)/articles', async (req, res) => { |
| 2 | const author = await AuthorRepository.byId(req.params.id); |
| 3 | ... |
| 4 | }); |
Explanation (EN)
Constraining the route param to digits only rejects malformed IDs (including comma-separated lists) with a 404 before the handler even runs.
Objašnjenje (HR)
Ograničavanje route parametra samo na znamenke odbacuje neispravne ID-eve (uključujući liste odvojene zarezom) s 404 greškom prije nego što handler uopće počne raditi.