fix: sanitize query parameter in DateController to prevent security vulnerabilities

- Add proper validation for newsId parameter in newsAction()
- Check for null/non-numeric values and return appropriate error responses
- Add validation for positive integer constraint
- Add null check for news object to prevent potential issues
- Return proper HTTP status codes (400 for bad request, 404 for not found)

Author: konradmichalik

Classes/Controller/DateController.php

@@ -57,8 +57,23 @@ public function notifiesAction(): ResponseInterface
 
     public function newsAction(): ResponseInterface
     {
-        $newsUid = $GLOBALS['TYPO3_REQUEST']->getQueryParams()['newsId'];
-        $news = $this->newsRepository->findByUid((int)$newsUid);
+        $queryParams = $GLOBALS['TYPO3_REQUEST']->getQueryParams();
+        $newsId = $queryParams['newsId'] ?? null;
+
+        if ($newsId === null || !is_numeric($newsId)) {
+            return new JsonResponse(['error' => 'Invalid or missing newsId parameter'], 400);
+        }
+
+        $newsUid = (int)$newsId;
+        if ($newsUid <= 0) {
+            return new JsonResponse(['error' => 'newsId must be a positive integer'], 400);
+        }
+
+        $news = $this->newsRepository->findByUid($newsUid);
+
+        if ($news === null) {
+            return new JsonResponse(['error' => 'News item not found'], 404);
+        }
 
         return new JsonResponse(
             [