From 1bebf163575dc3f0a8a936d630714f48292655e4 Mon Sep 17 00:00:00 2001
From: Tam Nhu Tran <kaitran.ntt@gmail.com>
Date: Wed, 11 Feb 2026 19:06:54 +0700
Subject: [PATCH] fix(cursor): add input validation on dashboard settings
 routes

---
 src/web-server/routes/cursor-settings-routes.ts | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/src/web-server/routes/cursor-settings-routes.ts b/src/web-server/routes/cursor-settings-routes.ts
index 03edb708..608512fc 100644
--- a/src/web-server/routes/cursor-settings-routes.ts
+++ b/src/web-server/routes/cursor-settings-routes.ts
@@ -31,6 +31,23 @@ router.get('/', (_req: Request, res: Response): void => {
 router.put('/', (req: Request, res: Response): void => {
   try {
     const updates = req.body;
+
+    // Validate input types
+    if (updates && typeof updates === 'object') {
+      if ('port' in updates && typeof updates.port !== 'number') {
+        res.status(400).json({ error: 'port must be a number' });
+        return;
+      }
+      if ('auto_start' in updates && typeof updates.auto_start !== 'boolean') {
+        res.status(400).json({ error: 'auto_start must be a boolean' });
+        return;
+      }
+      if ('ghost_mode' in updates && typeof updates.ghost_mode !== 'boolean') {
+        res.status(400).json({ error: 'ghost_mode must be a boolean' });
+        return;
+      }
+    }
+
     const config = loadOrCreateUnifiedConfig();
 
     // Merge updates with existing config