From f5a912b114107bdc26fdcacb936ac6bf4d9f50c5 Mon Sep 17 00:00:00 2001
From: Tam Nhu Tran <kaitran.ntt@gmail.com>
Date: Thu, 12 Feb 2026 04:08:16 +0700
Subject: [PATCH] fix(cursor): validate request body on settings endpoints

- Reject null/non-object bodies on PUT /settings with 400
- Validate settings field exists on PUT /settings/raw before write
- Use getCcsDir()-based path instead of hardcoded ~/.ccs/ in responses
---
 src/web-server/routes/cursor-settings-routes.ts | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/src/web-server/routes/cursor-settings-routes.ts b/src/web-server/routes/cursor-settings-routes.ts
index ef5dac6d..f0bea923 100644
--- a/src/web-server/routes/cursor-settings-routes.ts
+++ b/src/web-server/routes/cursor-settings-routes.ts
@@ -32,6 +32,12 @@ router.put('/', (req: Request, res: Response): void => {
   try {
     const updates = req.body;
 
+    // Reject non-object bodies
+    if (!updates || typeof updates !== 'object' || Array.isArray(updates)) {
+      res.status(400).json({ error: 'Request body must be a JSON object' });
+      return;
+    }
+
     // Validate input types
     if (updates && typeof updates === 'object') {
       if ('port' in updates) {
@@ -96,7 +102,7 @@ router.get('/raw', (_req: Request, res: Response): void => {
       res.json({
         settings: defaultSettings,
         mtime: Date.now(),
-        path: `~/.ccs/cursor.settings.json`,
+        path: settingsPath,
         exists: false,
       });
       return;
@@ -109,7 +115,7 @@ router.get('/raw', (_req: Request, res: Response): void => {
     res.json({
       settings,
       mtime: stat.mtimeMs,
-      path: `~/.ccs/cursor.settings.json`,
+      path: settingsPath,
       exists: true,
     });
   } catch (error) {
@@ -124,6 +130,12 @@ router.get('/raw', (_req: Request, res: Response): void => {
 router.put('/raw', (req: Request, res: Response): void => {
   try {
     const { settings, expectedMtime } = req.body;
+
+    if (!settings || typeof settings !== 'object') {
+      res.status(400).json({ error: 'settings must be a JSON object' });
+      return;
+    }
+
     const settingsPath = path.join(getCcsDir(), 'cursor.settings.json');
 
     // Check for conflict if file exists and expectedMtime provided