Behaviour mapping REST endpoint doesn't validate the input

If a POST request is made to this REST endpoint

/rest/scriptrunner/behaviours/latest/admin/mapping

with the following JSON body

{ "behaviourId": "1", "type": "project", "projectIds": ["null"], "issueTypeIds": ["10003"], "serviceDesk": "", "requestTypes": []}

the endpoint returns an HTTP error 500 and the behaviours page is no longer able to load existing behaviours.

There seems to be a missing validation of the projectIds field, it's not checking if the string value is actually a number.