From 0223bf4981e438c1da6db4d2344974ef1a6e36fd Mon Sep 17 00:00:00 2001
From: Sven Sauleau <sven@cloudflare.com>
Date: Mon, 13 Feb 2023 10:15:43 +0000
Subject: [PATCH] handle invalid search query

Closes https://github.com/cloudflare/wildebeest/issues/257
---
 backend/test/mastodon/search.spec.ts |  7 +++++++
 functions/api/v2/search.ts           | 10 +++++++++-
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/backend/test/mastodon/search.spec.ts b/backend/test/mastodon/search.spec.ts
index fb2952e..c865b59 100644
--- a/backend/test/mastodon/search.spec.ts
+++ b/backend/test/mastodon/search.spec.ts
@@ -168,5 +168,12 @@ describe('Mastodon APIs', () => {
 				assert.equal(data.accounts[1].display_name, 'bar')
 			}
 		})
+
+		test('empty results for invalid handle', async () => {
+			const db = await makeDB()
+			const req = new Request('https://example.com/api/v2/search?q=    ')
+			const res = await search.handleRequest(db, req)
+			assert.equal(res.status, 400)
+		})
 	})
 })
diff --git a/functions/api/v2/search.ts b/functions/api/v2/search.ts
index 408df1a..5fd9081 100644
--- a/functions/api/v2/search.ts
+++ b/functions/api/v2/search.ts
@@ -7,6 +7,7 @@ import { MastodonAccount } from 'wildebeest/backend/src/types/account'
 import { parseHandle } from 'wildebeest/backend/src/utils/parse'
 import { loadExternalMastodonAccount } from 'wildebeest/backend/src/mastodon/account'
 import { personFromRow } from 'wildebeest/backend/src/activitypub/actors'
+import type { Handle } from 'wildebeest/backend/src/utils/parse'
 
 const headers = {
 	...cors(),
@@ -38,7 +39,14 @@ export async function handleRequest(db: D1Database, request: Request): Promise<R
 		hashtags: [],
 	}
 
-	const query = parseHandle(url.searchParams.get('q') || '')
+	let query: Handle
+
+	try {
+		query = parseHandle(url.searchParams.get('q') || '')
+	} catch (err: any) {
+		return new Response('', { status: 400 })
+	}
+
 	if (useWebFinger && query.domain !== null) {
 		const acct = `${query.localPart}@${query.domain}`
 		const res = await queryAcct(query.domain, acct)