Add share_id validation.

pages/api/websites/[id]/index.ts

@@ -4,6 +4,7 @@ import { Website, NextApiRequestQueryBody } from 'lib/types';
 import { canViewWebsite, canUpdateWebsite, canDeleteWebsite } from 'lib/auth';
 import { useAuth, useCors } from 'lib/middleware';
 import { deleteWebsite, getWebsite, updateWebsite } from 'queries';
+import { SHARE_ID_REGEX } from 'lib/constants';
 
 export interface WebsiteRequestQuery {
   id: string;
@@ -43,6 +44,10 @@ export default async (
 
     let website;
 
+    if (shareId && !shareId.match(SHARE_ID_REGEX)) {
+      return serverError(res, 'Invalid share ID.');
+    }
+
     try {
       website = await updateWebsite(websiteId, { name, domain, shareId });
     } catch (e: any) {