fix: sanitize non-numeric pagination parameters using Number() insteAD

.github/workflows/rust.yml

@@ -21,11 +21,14 @@ jobs:
       - name: Set up Rust
         uses: dtolnay/rust-toolchain@stable
         with:
+          toolchain: 1.82.0
           components: rustfmt, clippy
           targets: wasm32-unknown-unknown
 
       - name: Cache Rust dependencies
         uses: Swatinem/rust-cache@v2
+        with:
+          cache-all-crates: true
 
       - name: Check formatting
         run: cargo fmt --all -- --check

app/app/api/posts/[id]/comments/route.ts

@@ -12,8 +12,10 @@ export async function GET(
   try {
     const { id } = await params;
     const { searchParams } = new URL(request.url);
-    const page = parseInt(searchParams.get("page") || "1");
-    const limit = parseInt(searchParams.get("limit") || "50");
+    const rawPage = Number(searchParams.get("page"));
+    const rawLimit = Number(searchParams.get("limit"));
+    const page = Number.isNaN(rawPage) || rawPage < 1 ? 1 : Math.floor(rawPage);
+    const limit = Number.isNaN(rawLimit) || rawLimit < 1 ? 20 : Math.min(Math.floor(rawLimit), 100);
     const skip = (page - 1) * limit;
 
     const [comments, total] = await Promise.all([

app/app/api/posts/[id]/entries/route.ts

@@ -303,15 +303,17 @@ export async function GET(
     const { id: postId } = await params;
     const { searchParams } = new URL(request.url);
 
-    const page = parseInt(searchParams.get("page") || "1");
-    const limit = parseInt(searchParams.get("limit") || "10");
-    const skip = (page - 1) * limit;
+    const rawPage = Number(searchParams.get("page"));
+    const rawLimit = Number(searchParams.get("limit"));
+    const page = searchParams.get("page") === null ? 1 : Math.floor(rawPage);
+    const limit = searchParams.get("limit") === null ? 10 : Math.floor(rawLimit);
 
-    // Validate pagination params
-    if (page < 1 || limit < 1 || limit > 100) {
+    if (Number.isNaN(page) || page < 1 || Number.isNaN(limit) || limit < 1 || limit > 100) {
       return apiError("Invalid pagination parameters", 400);
     }
 
+    const skip = (page - 1) * limit;
+
     // Check if post exists
     const post = await prisma.post.findUnique({
       where: { id: postId },

app/app/api/posts/route.ts

@@ -215,8 +215,10 @@ const GET = async (request: NextRequest) => {
     const status = searchParams.get("status");
     const from = searchParams.get("from");
     const to = searchParams.get("to");
-    const page = parseInt(searchParams.get("page") || "1");
-    const limit = parseInt(searchParams.get("limit") || "10");
+    const rawPage = Number(searchParams.get("page"));
+    const rawLimit = Number(searchParams.get("limit"));
+    const page = Number.isNaN(rawPage) || rawPage < 1 ? 1 : Math.floor(rawPage);
+    const limit = Number.isNaN(rawLimit) || rawLimit < 1 ? 20 : Math.min(Math.floor(rawLimit), 100);
 
     const where: Prisma.PostWhereInput = {};
     where.moderationStatus = { notIn: ["suspended", "banned"] };

app/app/api/users/[id]/followers/route.ts

@@ -9,8 +9,10 @@ export async function GET(
   try {
     const { id: targetUserId } = await params;
     const { searchParams } = new URL(request.url);
-    const limit = parseInt(searchParams.get('limit') || '20');
-    const skip = parseInt(searchParams.get('skip') || '0');
+    const rawLimit = Number(searchParams.get('limit'));
+    const rawSkip = Number(searchParams.get('skip'));
+    const limit = Number.isNaN(rawLimit) || rawLimit < 1 ? 20 : Math.min(Math.floor(rawLimit), 100);
+    const skip = Number.isNaN(rawSkip) || rawSkip < 0 ? 0 : Math.floor(rawSkip);
 
     // Followers are users who follow the target user
     // i.e., followingId = targetUserId

app/app/api/users/[id]/following/route.ts

@@ -9,8 +9,10 @@ export async function GET(
   try {
     const { id: targetUserId } = await params;
     const { searchParams } = new URL(request.url);
-    const limit = parseInt(searchParams.get('limit') || '20');
-    const skip = parseInt(searchParams.get('skip') || '0');
+    const rawLimit = Number(searchParams.get('limit'));
+    const rawSkip = Number(searchParams.get('skip'));
+    const limit = Number.isNaN(rawLimit) || rawLimit < 1 ? 20 : Math.min(Math.floor(rawLimit), 100);
+    const skip = Number.isNaN(rawSkip) || rawSkip < 0 ? 0 : Math.floor(rawSkip);
 
     // Following are users the target user follows
     // i.e., userId = targetUserId, followingId != null

contracts/geev-core/src/giveaway.rs

@@ -32,7 +32,7 @@ pub struct GiveawayWinnerSelected {
     prize_amount: i128,
 }
 
-#[allow(clippy::too_many_arguments)]
+
 #[allow(clippy::too_many_arguments)]
 #[contractimpl]
 impl GiveawayContract {