fix(vtex): sanitize query params to prevent NaN crashes

vtex/loaders/intelligentSearch/productListingPage.ts

@@ -161,20 +161,27 @@ export interface Props {
 }
 const searchArgsOf = (props: Props, url: URL) => {
   const hideUnavailableItems = props.hideUnavailableItems;
+  const VALID_SIM_BEHAVIORS = new Set(["default", "skip", "only1P"]);
+  const rawSim = url.searchParams.get("simulationBehavior");
   const simulationBehavior =
-    url.searchParams.get("simulationBehavior") as SimulationBehavior ||
-    props.simulationBehavior || "default";
+    (rawSim && VALID_SIM_BEHAVIORS.has(rawSim)
+      ? rawSim
+      : props.simulationBehavior || "default") as SimulationBehavior;
   const countFromSearchParams = url.searchParams.get("PS");
-  const count = Number(countFromSearchParams ?? props.count ?? 12);
+  const rawCount = countFromSearchParams ? Number(countFromSearchParams) : NaN;
+  const count = Number.isFinite(rawCount) && rawCount > 0
+    ? Math.min(Math.floor(rawCount), 50)
+    : Number(props.count ?? 12);
   const query = props.query ?? url.searchParams.get("q") ?? "";
   const currentPageoffset = props.pageOffset ?? 1;
+  const rawPage = url.searchParams.get("page")
+    ? Number(url.searchParams.get("page"))
+    : NaN;
+  const parsedPage = Number.isFinite(rawPage) && rawPage >= currentPageoffset
+    ? rawPage - currentPageoffset
+    : 0;
   const page = props.page ??
-    Math.min(
-      url.searchParams.get("page")
-        ? Number(url.searchParams.get("page")) - currentPageoffset
-        : 0,
-      VTEX_MAX_PAGES - currentPageoffset,
-    );
+    Math.min(parsedPage, VTEX_MAX_PAGES - currentPageoffset);
   const sort = (url.searchParams.get("sort")) ??
     LEGACY_TO_IS[url.searchParams.get("O") ?? ""] ??
     props.sort ??

vtex/loaders/legacy/productListingPage.ts

@@ -1,4 +1,8 @@
 import { LegacyItem } from "../../utils/types.ts";
+import {
+  removeNonLatin1Chars,
+  removeScriptChars,
+} from "../../../utils/normalize.ts";
 import type { Filter, ProductListingPage } from "../../../commerce/types.ts";
 import { STALE } from "../../../utils/fetch.ts";
 import { AppContext } from "../../mod.ts";
@@ -194,7 +198,10 @@ const loader = async (
   const filtersBehavior = props.filters || "dynamic";
 
   const countFromSearchParams = url.searchParams.get("PS");
-  const count = Number(countFromSearchParams ?? props.count ?? 12);
+  const rawCount = countFromSearchParams ? Number(countFromSearchParams) : NaN;
+  const count = Number.isFinite(rawCount) && rawCount > 0
+    ? Math.min(Math.floor(rawCount), 50)
+    : Number(props.count ?? 12);
 
   const maybeMap = props.map || url.searchParams.get("map") || undefined;
   let maybeTerm = props.term || url.pathname || "";
@@ -204,18 +211,25 @@ const loader = async (
     maybeTerm = result?.possiblePaths[0] ?? maybeTerm;
   }
 
-  const pageParam = url.searchParams.get("page")
-    ? Number(url.searchParams.get("page")) - currentPageoffset
+  const rawPage = url.searchParams.get("page")
+    ? Number(url.searchParams.get("page"))
+    : NaN;
+  const pageParam = Number.isFinite(rawPage) && rawPage >= currentPageoffset
+    ? rawPage - currentPageoffset
     : 0;
-  const page = props.page || pageParam;
-  const O: LegacySort = (url.searchParams.get("O") as LegacySort) ??
+  const page = props.page || Math.min(pageParam, MAX_ALLOWED_PAGES);
+  const rawSort = (url.searchParams.get("O") as LegacySort) ??
     IS_TO_LEGACY[url.searchParams.get("sort") ?? ""] ??
     props.sort ??
     sortOptions[0].value as LegacySort;
+  const isSortValid = sortOptions.some((opt) => opt.value === rawSort);
+  const O = isSortValid ? rawSort : sortOptions[0].value as LegacySort;
   const fq = [
     ...new Set([
       ...(props.fq ? [props.fq] : []),
-      ...url.searchParams.getAll("fq"),
+      ...url.searchParams.getAll("fq").map((v) =>
+        removeScriptChars(removeNonLatin1Chars(v))
+      ),
     ]),
   ];
   const _from = page * count;

vtex/middleware.ts

@@ -17,6 +17,36 @@ export const middleware = (
   req: Request,
   ctx: AppMiddlewareContext,
 ) => {
+  // Sanitize numeric query params early — invalid values (e.g. SSRF URLs
+  // passed as ?page=) cause NaN errors downstream in PLP loaders.
+  const url = new URL(req.url);
+  let dirty = false;
+
+  const page = url.searchParams.get("page");
+  if (page !== null) {
+    const num = Number(page);
+    if (!Number.isInteger(num) || num < 1) {
+      url.searchParams.delete("page");
+      dirty = true;
+    }
+  }
+
+  const ps = url.searchParams.get("PS");
+  if (ps !== null) {
+    const num = Number(ps);
+    if (!Number.isInteger(num) || num < 1 || num > 50) {
+      url.searchParams.delete("PS");
+      dirty = true;
+    }
+  }
+
+  if (dirty) {
+    return Promise.resolve(new Response(null, {
+      status: 301,
+      headers: { Location: url.pathname + url.search },
+    }));
+  }
+
   const segment = getSegmentFromBag(ctx);
   const isCookies = getISCookiesFromBag(ctx);
   const cookies = getCookies(req.headers);
@@ -31,15 +61,18 @@ export const middleware = (
 
   const isLoggedIn = Boolean(
     cookies[VTEX_ID_CLIENT_COOKIE] ||
-    cookies[`${VTEX_ID_CLIENT_COOKIE}_${ctx.account}`]
+      cookies[`${VTEX_ID_CLIENT_COOKIE}_${ctx.account}`],
   );
 
   const cacheable = isCacheableSegment(ctx) && !isLoggedIn;
 
   // PAGE_DIRTY_KEY: marks page dirty for section-level caching and other consumers
   if (!cacheable) {
     ctx.bag.set(PAGE_DIRTY_KEY, true);
-    ctx.response.headers.set("Cache-Control", "no-store, no-cache, must-revalidate");
+    ctx.response.headers.set(
+      "Cache-Control",
+      "no-store, no-cache, must-revalidate",
+    );
   }
 
   // PAGE_CACHE_ALLOWED_KEY: opts in to CDN page caching (VTEX-only)