From 19fcc00b3ee3697cec2c814262791bbce0933220 Mon Sep 17 00:00:00 2001
From: Rudy Celekli <rudy@gradiahq.com>
Date: Wed, 14 Oct 2026 20:15:09 -0400
Subject: [PATCH] fix(terrain): reject out-of-range points at the proxy
 boundary

Rebased onto current main with review follow-ups folded in.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                          |  2 ++
 docs/CURRENT-STATE.md                 |  4 ++++
 src/data/terrainHeightsProxy.js       |  8 +++++++-
 src/data/terrainHeightsProxy.test.mjs | 11 +++++++++++
 src/proxyErrorResponses.test.mjs      | 16 ++++++++++++++++
 5 files changed, 40 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a770fbd35..2d15df2d5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -33,6 +33,8 @@
 
 - Director timeline seeks cross the dateline along the short longitude arc.
 
+- The terrain proxy refuses out-of-range WGS84 coordinates before upstream resolution for every client.
+
 - Treat explicitly current, complete empty vessel coverage as a successful update,
   clearing obsolete contacts while retaining stale or incomplete snapshots.
 
diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index 1f794a5b5..73e521e01 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -1192,6 +1192,10 @@ The browser layers and their rendering remain in their existing modules.
 
 ## Terrain height cache bound
 
+The terrain proxy parser rejects finite longitudes outside [-180, 180] and
+latitudes outside [-90, 90] for every client before upstream resolution. One
+out-of-range point rejects the whole batch; inclusive WGS84 bounds remain valid.
+
 The client terrain-height resolver's in-memory cache is bounded at 20 000
 entries (`DEFAULT_MAX_CACHE_ENTRIES`, overridable per instance through
 `createTerrainHeights({ maxCacheEntries })`). Coordinate rounding makes repeated
diff --git a/src/data/terrainHeightsProxy.js b/src/data/terrainHeightsProxy.js
index bfb058693..9134f9ec6 100644
--- a/src/data/terrainHeightsProxy.js
+++ b/src/data/terrainHeightsProxy.js
@@ -35,7 +35,13 @@ export function parseTerrainPoints(raw) {
     if (parts.length !== 2) return null;
     const lon = Number(parts[0]);
     const lat = Number(parts[1]);
-    if (!Number.isFinite(lon) || !Number.isFinite(lat)) return null;
+    if (
+      !Number.isFinite(lon) ||
+      !Number.isFinite(lat) ||
+      Math.abs(lon) > 180 ||
+      Math.abs(lat) > 90
+    )
+      return null;
     points.push([lon, lat]);
   }
   return points;
diff --git a/src/data/terrainHeightsProxy.test.mjs b/src/data/terrainHeightsProxy.test.mjs
index f6b53de9a..50e45b732 100644
--- a/src/data/terrainHeightsProxy.test.mjs
+++ b/src/data/terrainHeightsProxy.test.mjs
@@ -3,6 +3,7 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import {
+  parseTerrainPoints,
   fetchTerrainChunkWithRetry,
   resolveTerrainHeightRequest,
   terrainPointKey,
@@ -227,3 +228,13 @@ test('malformed height objects remain refresh failures, not absent readings', as
     assert.equal(response.cacheChanged, false);
   }
 });
+
+test('terrain parser rejects out-of-range WGS84 points and accepts inclusive bounds', () => {
+  for (const value of ['181,0', '-181,0', '0,91', '0,-91', '1,2;0,91'])
+    assert.equal(parseTerrainPoints(value), null, value);
+  assert.deepEqual(parseTerrainPoints('-180,-90;180,90;0,0'), [
+    [-180, -90],
+    [180, 90],
+    [0, 0],
+  ]);
+});
diff --git a/src/proxyErrorResponses.test.mjs b/src/proxyErrorResponses.test.mjs
index 2b45a3b9e..c6a7269ab 100644
--- a/src/proxyErrorResponses.test.mjs
+++ b/src/proxyErrorResponses.test.mjs
@@ -2,6 +2,7 @@ import test from 'node:test';
 import assert from 'node:assert/strict';
 import { readFileSync } from 'node:fs';
 import path from 'node:path';
+import { parseTerrainPoints } from './data/terrainHeightsProxy.js';
 import { readResponseTextCapped, coalesceProxyRequest } from './sources/httpBody.js';
 
 const source = ['local.js', 'common/http.js', 'aircraft/enrichment.js', 'terrain.js', 'space/celestrak.js', 'space/launch-library.js', '../../src/data/spaceProviderRequests.js']
@@ -172,3 +173,18 @@ test('ADSBDB retains validation and missing-aircraft semantics', async () => {
   assert.equal(absent.status, 200);
   assert.deepEqual(JSON.parse(absent.body), { found: false });
 });
+
+for (const preview of [false, true]) {
+  test(`terrain server rejects out-of-range points before upstream resolution in ${preview ? 'preview' : 'development'}`, async () => {
+    let calls = 0;
+    const app = fixture('terrainHeightsProxy', { parseTerrainPoints,
+      resolveTerrainHeightRequest: async () => { calls++; return { status: 200, body: { results: [] } }; },
+    }, preview);
+    for (const points of ['181,0', '-181,0', '0,91', '0,-91', '1,2;0,91']) {
+      assert.equal((await app.request('/?points=' + encodeURIComponent(points))).status, 400);
+    }
+    assert.equal(calls, 0);
+    assert.equal((await app.request('/?points=-180,-90;180,90')).status, 200);
+    assert.equal(calls, 1);
+  });
+}