Hello! I was wondering if this code is "safe"? The code is a route handler intended to extract some params from the request. I'm wondering if there are any opportunities to exploit this though, and how I can make it better. Thanks!

import generateClient from '@/lib/shopify';
import { Product } from 'shopify-buy';
export async function GET(request: Request) {
    const url = request.url;

    const split = url.split('?');
    const params = split[1].split('&');

    let query = '';

    for (const param of params) {
        const split = param.split('=');
        if (split[0] === 'tag') {
            query = `tag:${split[1]}`;
        }
    }

    const client = generateClient();

client.graphQLClient.query((root: any) => {/* ... */});
    const data = await client.graphQLClient.send(productsQuery);
    const res = data.model.products;


    const products = /* ... */;

    return new Response(JSON.stringify(products));
}