From 4f986b0db30d0a18574d32e327962caa83e6c318 Mon Sep 17 00:00:00 2001
From: Guangshuo <zcrab@openai.com>
Date: Tue, 22 Sep 2026 14:20:10 -0700
Subject: [PATCH] fix(draw): reject invalid scene payloads

---
 plugins/draw/src/server/http.ts | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/plugins/draw/src/server/http.ts b/plugins/draw/src/server/http.ts
index 8623bf0..e8bc755 100644
--- a/plugins/draw/src/server/http.ts
+++ b/plugins/draw/src/server/http.ts
@@ -44,9 +44,12 @@ export function createHttpServer(opts: HttpServerOptions): http.Server {
       req.on('end', () => {
         try {
           const data = JSON.parse(body);
-          if (Array.isArray(data.elements)) {
-            opts.saveElements(data.elements);
+          if (!Array.isArray(data?.elements)) {
+            res.writeHead(400);
+            res.end('Expected an elements array');
+            return;
           }
+          opts.saveElements(data.elements);
           res.writeHead(200, { 'Content-Type': 'application/json' });
           res.end(JSON.stringify({ ok: true }));
         } catch {