From 87a6640c1d007aabe28d7f5001aa27f46e290c13 Mon Sep 17 00:00:00 2001
From: harsh-aghara <retrowrench.06@gmail.com>
Date: Mon, 1 Jun 2026 13:21:30 +0530
Subject: [PATCH] fix(backend): validate customUpCodes against standard HTTP
 status codes

Addresses reviewer feedback by enforcing strict validation on the  array. Previously, the Zod schema accepted any arbitrary number, which could allow invalid or self-defined HTTP codes (e.g., 5000) to be saved to the database.

Refs #3657
---
 server/src/validation/monitorValidation.ts    | 11 ++-
 .../unit/validation/monitorValidation.test.ts | 90 +++++++++++++++++++
 2 files changed, 97 insertions(+), 4 deletions(-)

diff --git a/server/src/validation/monitorValidation.ts b/server/src/validation/monitorValidation.ts
index 53a8ec6ca..22a1a241e 100644
--- a/server/src/validation/monitorValidation.ts
+++ b/server/src/validation/monitorValidation.ts
@@ -2,6 +2,9 @@ import { z } from "zod";
 import { booleanCoercion, dnsHostnameRegex, dnsServerValidation } from "./shared.js";
 import { GeoContinents } from "@/types/geoCheck.js";
 import { DnsRecordTypes, MonitorMatchMethods, MonitorStatuses, MonitorTypes, PageSpeedStrategies } from "@/types/monitor.js";
+import http from "node:http";
+
+const httpStatusCode = z.number().refine((code) => code.toString() in http.STATUS_CODES, { message: "Must be a valid HTTP status code" });
 
 export const getMonitorByIdParamValidation = z.object({
 	monitorId: z.string().min(1, "Monitor ID is required"),
@@ -81,7 +84,7 @@ export const createMonitorBodyValidation = z
 		tempAlertThreshold: z.number().optional(),
 		notifications: z.array(z.string()).optional(),
 		tags: z.array(z.string()).optional(),
-		customUpCodes: z.array(z.number()).default([]),
+		customUpCodes: z.array(httpStatusCode).default([]),
 		secret: z.string().optional(),
 		jsonPath: z.union([z.string(), z.literal("")]).optional(),
 		expectedValue: z.union([z.string(), z.literal("")]).optional(),
@@ -111,7 +114,7 @@ export const editMonitorBodyValidation = z
 		interval: z.number().optional(),
 		notifications: z.array(z.string()).optional(),
 		tags: z.array(z.string()).optional(),
-		customUpCodes: z.array(z.number()).optional(),
+		customUpCodes: z.array(httpStatusCode).optional(),
 		secret: z.string().optional(),
 		ignoreTlsErrors: z.boolean().optional(),
 		useAdvancedMatching: z.boolean().optional(),
@@ -182,7 +185,7 @@ const importedMonitorSchema = z
 		uptimePercentage: z.number().optional(),
 		notifications: z.array(z.string()).default([]),
 		tags: z.array(z.string()).default([]),
-		customUpCodes: z.array(z.number()).default([]),
+		customUpCodes: z.array(httpStatusCode).default([]),
 		secret: z.string().optional(),
 		cpuAlertThreshold: z.number().default(100),
 		cpuAlertCounter: z.number().default(5),
@@ -244,7 +247,7 @@ export const monitorResponseSchema = z
 		matchMethod: z.enum(MonitorMatchMethods).optional(),
 		notifications: z.array(z.string()),
 		tags: z.array(z.string()),
-		customUpCodes: z.array(z.number()).optional(),
+		customUpCodes: z.array(httpStatusCode).optional(),
 		secret: z.string().optional(),
 		cpuAlertThreshold: z.number(),
 		memoryAlertThreshold: z.number(),
diff --git a/server/test/unit/validation/monitorValidation.test.ts b/server/test/unit/validation/monitorValidation.test.ts
index 057ff6ae1..04cf2537e 100644
--- a/server/test/unit/validation/monitorValidation.test.ts
+++ b/server/test/unit/validation/monitorValidation.test.ts
@@ -222,3 +222,93 @@ describe("monitorValidation — strategy gating", () => {
 		});
 	});
 });
+
+describe("monitorValidation — customUpCodes", () => {
+	const baseHttpBody = {
+		name: "HTTP check",
+		type: "http" as const,
+		url: "https://example.com",
+	};
+
+	describe("createMonitorBodyValidation", () => {
+		it("accepts valid HTTP status codes", () => {
+			const parsed = createMonitorBodyValidation.parse({
+				...baseHttpBody,
+				customUpCodes: [200, 301, 404, 503],
+			});
+			expect(parsed.customUpCodes).toEqual([200, 301, 404, 503]);
+		});
+
+		it("rejects invalid HTTP status codes", () => {
+			expect(() =>
+				createMonitorBodyValidation.parse({
+					...baseHttpBody,
+					customUpCodes: [5000],
+				})
+			).toThrow();
+
+			expect(() =>
+				createMonitorBodyValidation.parse({
+					...baseHttpBody,
+					customUpCodes: [-1],
+				})
+			).toThrow();
+		});
+
+		it("defaults to an empty array when not provided", () => {
+			const parsed = createMonitorBodyValidation.parse(baseHttpBody);
+			expect(parsed.customUpCodes).toEqual([]);
+		});
+	});
+
+	describe("editMonitorBodyValidation", () => {
+		it("accepts valid HTTP status codes on edits", () => {
+			const parsed = editMonitorBodyValidation.parse({
+				customUpCodes: [200, 201],
+			});
+			expect(parsed.customUpCodes).toEqual([200, 201]);
+		});
+
+		it("rejects invalid HTTP status codes on edits", () => {
+			expect(() =>
+				editMonitorBodyValidation.parse({
+					customUpCodes: [9999],
+				})
+			).toThrow();
+		});
+	});
+
+	describe("importMonitorsBodyValidation", () => {
+		it("retains valid HTTP status codes on imported HTTP monitors", () => {
+			const parsed = importMonitorsBodyValidation.parse({
+				monitors: [
+					{
+						...baseHttpBody,
+						customUpCodes: [404],
+					},
+				],
+			});
+			expect(parsed.monitors[0].customUpCodes).toEqual([404]);
+		});
+
+		it("rejects invalid HTTP status codes on imported HTTP monitors", () => {
+			expect(() =>
+				importMonitorsBodyValidation.parse({
+					monitors: [
+						{
+							...baseHttpBody,
+							customUpCodes: [5000],
+						},
+					],
+				})
+			).toThrow();
+		});
+
+		it("defaults to an empty array when not provided on import", () => {
+			const parsed = importMonitorsBodyValidation.parse({
+				monitors: [baseHttpBody],
+			});
+			expect(parsed.monitors[0].customUpCodes).toEqual([]);
+		});
+	});
+});