# Bugs Found 2026-05-11

The first batch (7 items: pending-beacon access control, per_page contract,
rate-limiter ETS lifecycle, unbounded grid endpoints, NEXRAD PNG quadratic
unfilter, LiveTableFooter parser, ScoresFile parser) was fixed and removed
from this file as each was resolved. The items below are additional bugs
surfaced by a follow-up audit.

## A. `String.to_integer` on user-controlled `band` param crashes LiveViews

**Status:** Fixed.
**Severity:** High
**Category:** Availability / unhandled crash on user input
**Files:**
- `lib/microwaveprop_web/live/path_live.ex` (formerly lines 227, 284)
- `lib/microwaveprop_web/live/map_live.ex` (formerly line 198)

`PathLive.handle_event("calculate", …)` and the auto-calculate path both
called `String.to_integer(params["band"])` directly on the `band` form
parameter. `MapLive.handle_event("select_band", %{"value" => band}, …)`
did the same. A non-numeric `band` value — supplied via a hand-crafted
URL (`/path?band=abc`) or a misbehaving JS hook — raised `ArgumentError`
inside the LiveView process and crashed the channel.

**Fix:** Use the existing `LiveHelpers.parse_int/2` (PathLive) and the
existing `parse_band_param/1` plus a small `normalize_band_event/1` helper
(MapLive). Unknown bands now fall back to a safe default or a no-op
instead of crashing the process.