[Detail Bug] ETA API accepts invalid coordinates because RouteLocation does not validate latitude/longitude

[detail-app]

Detail Bug Report

https://app.detail.dev/org_befd6425-a158-4e24-9d4d-1e5c08769515/bugs/bug_a673e186-0a31-4ce4-b8e8-fa666b2437c6

Introduced in #34 by @WilliamAGH on Jan 23, 2026

Summary

• Context: RouteLocation is a domain record that creates coordinate pairs for ETA requests via fromLatitudeLongitude(double, double).
• Bug: The factory method does not validate coordinate bounds, allowing invalid coordinates (NaN, Infinity, out-of-range values) to silently pass through.
• Actual vs. expected: The method accepts any double values without validation, while DirectionsEndpoint.fromLatitudeLongitude() correctly validates coordinates.
• Impact: Core ETA API inputs lack the fail-fast validation applied to directions inputs.

Code with Bug

public static RouteLocation fromLatitudeLongitude(double latitude, double longitude) {
    return new RouteLocation(formatCoordinatePair(latitude, longitude)); // <-- BUG 🔴 missing validateLatitudeLongitude; invalid coords pass through
}

Reference behavior in directions:

public static DirectionsEndpoint fromLatitudeLongitude(double latitude, double longitude) {
    Location.validateLatitudeLongitude(latitude, longitude);
    return new DirectionsEndpoint(formatCoordinatePair(latitude, longitude));
}

Explanation

RouteLocation is a required routing parameter for /etas (via EtaInput.builder(origin, destinations)), analogous to DirectionsEndpoint for /directions. Because RouteLocation.fromLatitudeLongitude() does not call Location.validateLatitudeLongitude, invalid values (e.g., 91.0, 200.0, Double.NaN, Double.POSITIVE_INFINITY) can be constructed and sent to the ETA API, where they only fail later at the Apple Maps API boundary instead of failing fast with a clear IllegalArgumentException.

Codebase Inconsistency

Both routing builders enforce these values as required inputs, but only directions validates:

public static Builder builder(RouteLocation origin, List<RouteLocation> destinations) {
    return new Builder(origin, destinations);
}

public static Builder builder(DirectionsEndpoint origin, DirectionsEndpoint destination) {
    return new Builder(origin, destination);
}

Recommended Fix

Add validation to RouteLocation.fromLatitudeLongitude():

public static RouteLocation fromLatitudeLongitude(double latitude, double longitude) {
    Location.validateLatitudeLongitude(latitude, longitude);
    return new RouteLocation(formatCoordinatePair(latitude, longitude));
}

History

This bug was introduced in commit f83c5e2. The commit added coordinate validation to Location.validateLatitudeLongitude() and applied it to DirectionsEndpoint.fromLatitudeLongitude(), but omitted the same validation call in RouteLocation.fromLatitudeLongitude().