From 7ce256baa5dc75c24cd2955caa4b23825b2e5f88 Mon Sep 17 00:00:00 2001
From: Jonny Barnes <hi@jonnybarnes.uk>
Date: Thu, 29 Oct 2026 19:01:28 +0000
Subject: [PATCH] Return 404 for non-numeric like and bookmark IDs

Constrain the likes/{like} and bookmarks/{bookmark} routes to numeric
IDs. Previously a junk URL such as /likes/twcamp^share|twsrc^ios was
passed to route model binding, and Postgres rejected the text-vs-integer
comparison with a QueryException, returning a 500 instead of a 404.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 routes/web.php                  | 4 ++--
 tests/Feature/BookmarksTest.php | 7 +++++++
 tests/Feature/LikesTest.php     | 7 +++++++
 3 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/routes/web.php b/routes/web.php
index a9b46407..d7e1ee2f 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -211,14 +211,14 @@ Route::get('note/{id}', [NotesController::class, 'redirect']); // for legacy not
 // Likes
 Route::prefix('likes')->group(function () {
     Route::get('/', [LikesController::class, 'index']);
-    Route::get('/{like}', [LikesController::class, 'show']);
+    Route::get('/{like}', [LikesController::class, 'show'])->whereNumber('like');
 });
 
 // Bookmarks
 Route::prefix('bookmarks')->group(function () {
     Route::get('/', [BookmarksController::class, 'index']);
     Route::redirect('/tagged', '/bookmarks');
-    Route::get('/{bookmark}', [BookmarksController::class, 'show']);
+    Route::get('/{bookmark}', [BookmarksController::class, 'show'])->whereNumber('bookmark');
     Route::get('/tagged/{tag}', [BookmarksController::class, 'tagged']);
 });
 
diff --git a/tests/Feature/BookmarksTest.php b/tests/Feature/BookmarksTest.php
index 7b741033..83f36d32 100644
--- a/tests/Feature/BookmarksTest.php
+++ b/tests/Feature/BookmarksTest.php
@@ -32,6 +32,13 @@ class BookmarksTest extends TestCase
         $response->assertViewIs('bookmarks.show');
     }
 
+    #[Test]
+    public function non_numeric_bookmark_id_gives_not_found_response(): void
+    {
+        $response = $this->get('/bookmarks/twcamp^share|twsrc^ios');
+        $response->assertNotFound();
+    }
+
     #[Test]
     public function when_bookmark_is_added_using_http_syntax_check_job_to_take_screenshot_is_invoked(): void
     {
diff --git a/tests/Feature/LikesTest.php b/tests/Feature/LikesTest.php
index 2bda91f3..b08f0d37 100644
--- a/tests/Feature/LikesTest.php
+++ b/tests/Feature/LikesTest.php
@@ -178,4 +178,11 @@ class LikesTest extends TestCase
         $response = $this->get('/likes/202');
         $response->assertNotFound();
     }
+
+    #[Test]
+    public function non_numeric_like_id_gives_not_found_response(): void
+    {
+        $response = $this->get('/likes/twcamp^share|twsrc^ios');
+        $response->assertNotFound();
+    }
 }