Skip to content

fix: sanitize non-numeric pagination parameters using Number() insteAD#380

Open
Clinton6801 wants to merge 8 commits into
geevapp:mainfrom
Clinton6801:fix/sanitize-non-numeric-pagination
Open

fix: sanitize non-numeric pagination parameters using Number() insteAD#380
Clinton6801 wants to merge 8 commits into
geevapp:mainfrom
Clinton6801:fix/sanitize-non-numeric-pagination

Conversation

@Clinton6801

Copy link
Copy Markdown
Contributor

Fix Issue #358: Sanitize Non-Numeric Pagination Parameters

Problem

List endpoints were returning HTTP 500 errors when receiving non-numeric pagination query parameters (e.g., ?page=abc&limit=-5).

Root cause: parseInt("abc") returns NaN, and the condition NaN < 1 evaluates to false, causing invalid values to pass validation and crash Prisma queries.

Solution

Replaced parseInt() with Number() and added explicit Number.isNaN() checks in all pagination parameter parsing across list endpoints.

Changes

  • 5 route files updated with consistent pagination sanitization:
    • app/app/api/posts/route.ts
    • app/app/api/posts/[id]/comments/route.ts
    • app/app/api/posts/[id]/entries/route.ts
    • app/app/api/users/[id]/followers/route.ts
    • app/app/api/users/[id]/following/route.ts

Parsing Pattern

const rawPage = Number(searchParams.get("page"));
const rawLimit = Number(searchParams.get("limit"));
const page = Number.isNaN(rawPage) || rawPage < 1 ? 1 : Math.floor(rawPage);
const limit = Number.isNaN(rawLimit) || rawLimit < 1 ? 20 : Math.min(Math.floor(rawLimit), 100);
Behavior After Fix
Input	Before	After
?page=abc&limit=-5	 500	 200 (page=1, limit=20)
?page=0&limit=200	 500	 200 (page=1, limit=100)
?page=2&limit=10	 200	 200 (page=2, limit=10)
Testing
Invalid pagination params now gracefully default to safe values
Endpoints return 200 with properly paginated data instead of 500
All existing valid pagination requests continue to work as expected
Backwards Compatibility
 Fully backwards compatible  Valid requests are unaffected; only invalid requests now behave gracefully instead of crashing.

closes #358 

@Clinton6801 Clinton6801 force-pushed the fix/sanitize-non-numeric-pagination branch from 4bb915e to a6752b9 Compare June 25, 2026 17:05
@Clinton6801 Clinton6801 force-pushed the fix/sanitize-non-numeric-pagination branch from 31d37a9 to 03a7172 Compare June 25, 2026 17:09
@Clinton6801 Clinton6801 force-pushed the fix/sanitize-non-numeric-pagination branch from 8055c95 to c72d727 Compare June 25, 2026 17:13
@Clinton6801 Clinton6801 force-pushed the fix/sanitize-non-numeric-pagination branch from 36cedde to 0138ee4 Compare June 25, 2026 17:16

@3m1n3nc3 3m1n3nc3 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a specific reason for the rust file modifications you made?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants