From f83f647299fe4e650052371e0c5efd1aa9801be9 Mon Sep 17 00:00:00 2001
From: enkeii64 <imenkei64@gmail.com>
Date: Wed, 16 Jul 2025 22:43:01 +1000
Subject: [PATCH] refactor: improve type safety and security in projects page

---
 apps/web/src/app/projects/page.tsx | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/apps/web/src/app/projects/page.tsx b/apps/web/src/app/projects/page.tsx
index 16722815..e68c70c4 100644
--- a/apps/web/src/app/projects/page.tsx
+++ b/apps/web/src/app/projects/page.tsx
@@ -99,8 +99,14 @@ export default function ProjectsPage() {
 
   const sortedProjects = [...filteredProjects].sort((a, b) => {
     const [key, order] = sortOption.split("-");
-    const aValue = a[key as keyof TProject];
-    const bValue = b[key as keyof TProject];
+
+    if (key !== "createdAt" && key !== "name") {
+      console.warn(`Invalid sort key: ${key}`);
+      return 0;
+    }
+
+    const aValue = a[key];
+    const bValue = b[key];
 
     if (aValue === undefined || bValue === undefined) return 0;
 
@@ -578,10 +584,12 @@ function ProjectCard({
 }
 
 function Highlight({ text, query }: { text: string; query?: string }) {
-  if (!query) {
+  if (!query || query.trim() === "") {
     return <span>{text}</span>;
   }
-  const parts = text.split(new RegExp(`(${query})`, "gi"));
+
+  const escapedQuery = query.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const parts = text.split(new RegExp(`(${escapedQuery})`, "gi"));
   return (
     <span>
       {parts.map((part, i) =>