Add doc ID validation to prevent arbitrary URL document creation

- Add isValidDocId() validation function to generateDocId.ts
- Update App.tsx to validate doc IDs and redirect invalid ones to Landing
- Update Landing.tsx to show error message for invalid document IDs
- Add doc ID format validation to SharingController endpoints

This prevents documents from being created when users visit arbitrary
URLs like /somedoc. Valid IDs must be exactly 21 characters using
URL-safe characters (A-Za-z0-9_-) matching the nanoid format.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: ajha-dev

frontend/src/App.tsx

@@ -2,12 +2,14 @@
  * App Component
  *
  * Root component that extracts doc ID from URL and renders the Editor.
+ * Validates doc ID format and redirects invalid IDs to landing page.
  */
 
 import { useEffect } from "react";
 import { Editor } from "./components/Editor";
 import { Landing } from "./components/Landing";
 import { initImportBridge } from "./lib/importBridge";
+import { isValidDocId } from "./lib/generateDocId";
 
 function App() {
   // Initialize import bridge on mount
@@ -16,7 +18,6 @@ function App() {
   }, []);
 
   // Extract doc ID from URL path
-  // Examples: /abc123 → "abc123", /meeting-notes → "meeting-notes"
   const path = window.location.pathname;
   const docId = path.slice(1);
 
@@ -25,6 +26,12 @@ function App() {
     return <Landing />;
   }
 
+  // Validate doc ID format - must be a valid nanoid (21 chars, A-Za-z0-9_-)
+  // Invalid IDs redirect to landing page to prevent accidental doc creation
+  if (!isValidDocId(docId)) {
+    return <Landing invalidDocId={docId} />;
+  }
+
   return <Editor docId={docId} />;
 }
 

frontend/src/components/Landing.tsx

@@ -1,14 +1,18 @@
 /**
  * Landing Component
  *
- * First screen shown when visiting root path '/'.
+ * First screen shown when visiting root path '/' or an invalid document ID.
  * Collects username and redirects to a new document with random ID.
  */
 
 import { useState, useEffect, type FormEvent } from "react";
 import { generateDocId } from "../lib/generateDocId";
 
-export function Landing() {
+interface LandingProps {
+  invalidDocId?: string;
+}
+
+export function Landing({ invalidDocId }: LandingProps) {
   const [name, setName] = useState("");
 
   // Pre-fill name from localStorage if exists
@@ -76,9 +80,23 @@ export function Landing() {
             lineHeight: "1.5",
           }}
         >
-          A collaborative markdown editor for real-time team collaboration.
-          <br />
-          Create a new document to get started.
+          {invalidDocId ? (
+            <>
+              <span style={{ color: "#cf222e", fontWeight: 500 }}>
+                Invalid document ID: "{invalidDocId}"
+              </span>
+              <br />
+              Document IDs must be exactly 21 characters (A-Z, a-z, 0-9, _, -).
+              <br />
+              Create a new document to get started.
+            </>
+          ) : (
+            <>
+              A collaborative markdown editor for real-time team collaboration.
+              <br />
+              Create a new document to get started.
+            </>
+          )}
         </p>
 
         <form onSubmit={handleSubmit}>

frontend/src/lib/generateDocId.ts

@@ -1,5 +1,11 @@
 import { nanoid } from "nanoid";
 
+/**
+ * Valid doc ID pattern: 21 characters, URL-safe (A-Za-z0-9_-)
+ * This matches the nanoid default output format.
+ */
+const DOC_ID_PATTERN = /^[A-Za-z0-9_-]{21}$/;
+
 /**
  * Generates a unique document ID using nanoid.
  *
@@ -12,3 +18,17 @@ import { nanoid } from "nanoid";
 export function generateDocId(): string {
   return nanoid();
 }
+
+/**
+ * Validates if a string is a valid document ID.
+ *
+ * Valid IDs must:
+ * - Be exactly 21 characters long
+ * - Only contain URL-safe characters (A-Za-z0-9_-)
+ *
+ * @param id - The string to validate
+ * @returns true if valid, false otherwise
+ */
+export function isValidDocId(id: string): boolean {
+  return DOC_ID_PATTERN.test(id);
+}

lib/markdoc_web/controllers/sharing_controller.ex

@@ -11,6 +11,9 @@ defmodule MarkdocWeb.SharingController do
 
   alias Markdoc.{DocServer, DocSupervisor, DocRegistry}
 
+  # Valid doc ID pattern: 21 characters, URL-safe (A-Za-z0-9_-)
+  @doc_id_pattern ~r/^[A-Za-z0-9_-]{21}$/
+
   @doc """
   GET /api/docs/:doc_id/sharing
 
@@ -19,7 +22,8 @@ defmodule MarkdocWeb.SharingController do
   def show(conn, %{"doc_id" => doc_id}) do
     auth_user = conn.assigns[:auth_user]
 
-    with :ok <- ensure_authenticated(auth_user),
+    with :ok <- validate_doc_id(doc_id),
+         :ok <- ensure_authenticated(auth_user),
          :ok <- ensure_doc_exists(doc_id),
          metadata <- DocServer.get_metadata(doc_id),
          :ok <- ensure_owner(auth_user, metadata) do
@@ -30,6 +34,11 @@ defmodule MarkdocWeb.SharingController do
         owner_email: metadata.owner_email
       })
     else
+      {:error, :invalid_doc_id} ->
+        conn
+        |> put_status(:bad_request)
+        |> json(%{error: "bad_request", reason: "invalid_doc_id"})
+
       {:error, :not_authenticated} ->
         conn
         |> put_status(:unauthorized)
@@ -59,7 +68,8 @@ defmodule MarkdocWeb.SharingController do
   def update(conn, %{"doc_id" => doc_id} = params) do
     auth_user = conn.assigns[:auth_user]
 
-    with :ok <- ensure_authenticated(auth_user),
+    with :ok <- validate_doc_id(doc_id),
+         :ok <- ensure_authenticated(auth_user),
          :ok <- ensure_doc_exists(doc_id),
          metadata <- DocServer.get_metadata(doc_id),
          :ok <- ensure_owner(auth_user, metadata),
@@ -85,6 +95,11 @@ defmodule MarkdocWeb.SharingController do
           |> json(%{error: "update_failed", reason: inspect(reason)})
       end
     else
+      {:error, :invalid_doc_id} ->
+        conn
+        |> put_status(:bad_request)
+        |> json(%{error: "bad_request", reason: "invalid_doc_id"})
+
       {:error, :not_authenticated} ->
         conn
         |> put_status(:unauthorized)
@@ -114,6 +129,16 @@ defmodule MarkdocWeb.SharingController do
 
   ## Private Functions
 
+  defp validate_doc_id(doc_id) when is_binary(doc_id) do
+    if Regex.match?(@doc_id_pattern, doc_id) do
+      :ok
+    else
+      {:error, :invalid_doc_id}
+    end
+  end
+
+  defp validate_doc_id(_), do: {:error, :invalid_doc_id}
+
   defp ensure_authenticated(%{authenticated: true}), do: :ok
   defp ensure_authenticated(_), do: {:error, :not_authenticated}
 

priv/static/index.html

@@ -9,8 +9,8 @@
     <link rel="manifest" href="site.webmanifest" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>MarkDoc</title>
-    <script type="module" crossorigin src="/assets/index-DrGMR03A.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-BzwhaErm.css">
+    <script type="module" crossorigin src="/assets/index-mmX9Txq4.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-mk5zstl2.css">
   </head>
   <body>
     <div id="root"></div>