closes #6680

src/routes/feeds.js

@@ -154,7 +154,9 @@ function generateForCategory(req, res, next) {
 	}
 	var cid = req.params.category_id;
 	var category;
-
+	if (!parseInt(cid, 10)) {
+		return next();
+	}
 	async.waterfall([
 		function (next) {
 			async.parallel({

test/feeds.js

@@ -83,6 +83,14 @@ describe('feeds', function () {
 		});
 	});
 
+	it('should 404 if category id is not a number', function (done) {
+		request(nconf.get('url') + '/category/invalid.rss', function (err, res) {
+			assert.ifError(err);
+			assert.equal(res.statusCode, 404);
+			done();
+		});
+	});
+
 	it('should redirect if we do not have read privilege', function (done) {
 		privileges.categories.rescind(['topics:read'], cid, 'guests', function (err) {
 			assert.ifError(err);