Bug: GET /api/models does not enforce maximum limit, allows full database scrape

[anshul23102]

Bug Report: Unbounded limit Parameter Allows Full Dataset Retrieval

Description

The GET /api/models endpoint accepts a limit query parameter that is
validated against NaN (tracked separately) but has no upper bound. A caller
can pass limit=100000 to retrieve the entire model database in a single
HTTP response, bypassing rate limiting intent and causing the Next.js API
route to load the full Prisma result set into memory.

Steps to Reproduce

1. Call the API with an extreme limit:

   GET /api/models?limit=100000&offset=0
   

2. Observe all records are returned in one response.
3. Monitor the Next.js server process memory during the request.

Root Cause

The limit parameter is parsed with parseInt but validated only for NaN,
not for an upper boundary. The Prisma query's take is set directly to the
parsed value.

Impact

The entire AI model directory can be bulk-scraped with a single request,
defeating any rate-limiting strategy based on per-request cost. Large result
sets also cause memory spikes in the serverless function runtime.

Proposed Fix

Cap the limit parameter at a reasonable maximum:

const limit = Math.min(Math.max(parseInt(searchParams.get("limit") ?? "20"), 1), 100);
const offset = Math.max(parseInt(searchParams.get("offset") ?? "0"), 0);

if (isNaN(limit) || isNaN(offset)) {
  return NextResponse.json({ error: "Invalid pagination parameters" }, { status: 400 });
}

[anshul23102]

@AditthyaSS Hi! I came across this issue and I would love to work on it as part of GSSoC '26.

I have reviewed the problem description carefully and am confident I can deliver a well-tested, production-ready fix within the contribution timeline. Please let me know if you need any additional context or have specific implementation preferences before I get started.

Could you please assign this issue to me?

/assign
/claim