Potential fix for code scanning alert no. 13: Type confusion through parameter tampering

[kkartunov]

Potential fix for https://github.com/topcoder-platform/identity-api-v6/security/code-scanning/13

To fix the vulnerability, the code must validate at the entry point (the controller method or at the very beginning of processing) that handle is a string—and not an array, object, or other type—before using string methods. The best way is:

• In the validateHandle controller method (user.controller.ts), check if handle is a string. If not, throw a BadRequestException (just like if it were missing), or coerce to string as appropriate.
• Optionally, add similar checks in ValidationService.validateHandle and/or other service methods that process handle, unless we are sure all entry points are protected by the controller check.

All code paths that depend on handle being a string (especially those that call .length, .charAt, etc.) will then be safe from type confusion by this early validation.

Changes required:

• In src/api/user/user.controller.ts, in the validateHandle controller method, add a check immediately after receiving the value for handle to ensure it's a string.
• Throw a BadRequestException if typeof handle !== 'string' or Array.isArray(handle) is true (since arrays will have typeof 'object').
• No new dependencies are needed, as these checks use built-in JS/TS features.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[github-actions]

[💡 maintainability]
The check Array.isArray(handle) is redundant since typeof handle !== 'string' already covers non-string types, including arrays. Consider removing it for simplicity.