Merge pull request #9847 from weseek/fix/assert-param-is-string

fix: CodeQL problem "Database query built from user-controlled sources"

apps/app/src/features/openai/server/routes/thread.ts

@@ -42,8 +42,11 @@ export const createThreadHandlersFactory: CreateThreadFactory = (crowi) => {
         return res.apiv3Err(new ErrorV3('GROWI AI is not enabled'), 501);
       }
 
+      const { aiAssistantId, initialUserMessage } = req.body;
+
+      // express-validator ensures aiAssistantId is a string
+
       try {
-        const { aiAssistantId, initialUserMessage } = req.body;
 
         const isAiAssistantUsable = await openaiService.isAiAssistantUsable(aiAssistantId, req.user);
         if (!isAiAssistantUsable) {