Aug 26 - Enhance security 3

app/routes/sharing.py

@@ -131,19 +131,28 @@ def create_share():
     iv_name = data.get('iv_name') or None
     # Optional expiry: number of days until the share expires (None = never).
     # Accepted values: 1, 7, 30, 90, None.
+    # Fail closed: a value we cannot parse must be an error, not "never
+    # expires". The previous `except: pass` meant a typo or a client bug
+    # silently produced a permanent share — the opposite of what was asked for.
     expires_days = data.get('expires_days')
     expires_at = None
     if expires_days is not None:
         try:
             expires_days = int(expires_days)
-            if expires_days > 0:
-                from datetime import timedelta
-                expires_at = (
-                    datetime.now(timezone.utc).replace(tzinfo=None)
-                    + timedelta(days=expires_days)
-                )
         except (TypeError, ValueError):
-            pass
+            return jsonify({
+                'error': 'expires_days must be an integer number of days, or null for no expiry'
+            }), 400
+        if expires_days < 0 or expires_days > 3650:
+            return jsonify({
+                'error': 'expires_days must be between 0 and 3650'
+            }), 400
+        if expires_days > 0:
+            from datetime import timedelta
+            expires_at = (
+                datetime.now(timezone.utc).replace(tzinfo=None)
+                + timedelta(days=expires_days)
+            )
 
     if not all([item_id, recipient_email, enc_data, iv, item_name]):
         return jsonify({'error': 'item_id, recipient_email, enc_data, iv, item_name are required'}), 400