fix: validate viewport and geolocation inputs in emulate tool (#2663)

Fixes #2662

src/tools/ToolDefinition.ts

@@ -492,6 +492,21 @@ export function viewportTransform(arg: string | undefined):
     number,
     number | undefined,
   ];
+  if (!Number.isFinite(width) || width <= 0) {
+    throw new Error(
+      `Invalid viewport width "${width}". Expected format '<width>x<height>x<devicePixelRatio>[,mobile][,touch][,landscape]' with a positive width.`,
+    );
+  }
+  if (!Number.isFinite(height) || height <= 0) {
+    throw new Error(
+      `Invalid viewport height "${height}". Expected format '<width>x<height>x<devicePixelRatio>[,mobile][,touch][,landscape]' with a positive height.`,
+    );
+  }
+  if (dpr !== undefined && (!Number.isFinite(dpr) || dpr <= 0)) {
+    throw new Error(
+      `Invalid devicePixelRatio "${dpr}". Expected a positive number.`,
+    );
+  }
   return {
     width,
     height,
@@ -507,6 +522,16 @@ export function geolocationTransform(arg: string | undefined) {
     return undefined;
   }
   const [latitude, longitude] = arg.split(',').map(Number) as [number, number];
+  if (!Number.isFinite(latitude) || latitude < -90 || latitude > 90) {
+    throw new Error(
+      `Invalid latitude "${latitude}". Latitude must be a number between -90 and 90.`,
+    );
+  }
+  if (!Number.isFinite(longitude) || longitude < -180 || longitude > 180) {
+    throw new Error(
+      `Invalid longitude "${longitude}". Longitude must be a number between -180 and 180.`,
+    );
+  }
   return {
     latitude,
     longitude,

tests/tools/emulation.test.ts

@@ -68,6 +68,26 @@ describe('emulation', () => {
           isLandscape: true,
         });
       });
+
+      it('throws on non-numeric dimensions', () => {
+        assert.throws(() => viewportTransform('abc'));
+      });
+
+      it('throws when width is not positive', () => {
+        assert.throws(() => viewportTransform('0x600'));
+      });
+
+      it('throws when height is not positive', () => {
+        assert.throws(() => viewportTransform('800x0'));
+      });
+
+      it('throws when devicePixelRatio is not positive', () => {
+        assert.throws(() => viewportTransform('1024x768x0'));
+      });
+
+      it('throws when height is missing', () => {
+        assert.throws(() => viewportTransform('800'));
+      });
     });
 
     describe('geolocationTransform', () => {
@@ -81,6 +101,22 @@ describe('emulation', () => {
           longitude: 11.576124,
         });
       });
+
+      it('throws when latitude is out of range', () => {
+        assert.throws(() => geolocationTransform('999,999'));
+      });
+
+      it('throws when longitude is out of range', () => {
+        assert.throws(() => geolocationTransform('48.1,999'));
+      });
+
+      it('throws on non-numeric input', () => {
+        assert.throws(() => geolocationTransform('abc,def'));
+      });
+
+      it('throws when longitude is missing', () => {
+        assert.throws(() => geolocationTransform('48.1'));
+      });
     });
   });