Skip to content

Non-numeric pagination query params produce 500s across list endpoints #358

Description

@3m1n3nc3

Description

Multiple list endpoints parse pagination with parseInt(...) and guard with value < 1. Because parseInt("abc") is NaN and NaN < 1 is false, invalid values slip past validation and are passed to Prisma skip/take, which throws and returns a generic 500. There is also no upper bound on limit, allowing unbounded page sizes.

More info

  • File: app/app/api/posts/route.ts (GET, approx. lines 218-219)
  • File: app/app/api/posts/[id]/entries/route.ts (approx. lines 306-307)
  • File: app/app/api/posts/[id]/comments/route.ts (approx. lines 15-17)
  • Files: app/app/api/users/[id]/followers/route.ts, app/app/api/users/[id]/following/route.ts
  • Parse with Number(...) || default, guard Number.isNaN, and clamp to [1, MAX].
  • Add a test sending ?page=abc&limit=-5 and asserting a sane default response (not 500).

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No fields configured for Bug.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions