fix: reject array profile payloads

2026-07-20 18:27:29 +08:00
parent 4441d0f089
commit d757602e7c
3 changed files with 10 additions and 2 deletions
@@ -95,7 +95,7 @@ export async function PATCH(request: Request) {
    }

    const payload = await request.json().catch(() => null) as ProfilePatchPayload | null;
-    if (!payload || typeof payload !== "object") {
+    if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
      return NextResponse.json({ error: "账户资料格式不正确" }, { status: 400 });
    }

@@ -41,7 +41,7 @@ export async function POST(request: Request) {
    if (!user) return NextResponse.json({ error: "请先登录" }, { status: 401 });

    const body = await request.json().catch(() => null) as ChartProfilePayload | null;
-    if (!body?.profile || typeof body.profile !== "object") {
+    if (!body?.profile || typeof body.profile !== "object" || Array.isArray(body.profile)) {
      return NextResponse.json({ error: "星盘资料格式不正确" }, { status: 400 });
    }
    const role = body.role === "self" ? "self" : "other";