Skip to content

fix(projector): parseLimit honours only decimal-digit spellings (#2971) #3077

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dezren39 merged 1 commit into from
Oct 31, 2026
Merged

fix(projector): parseLimit honours only decimal-digit spellings (#2971) #3077

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion pm-stack/projector/src/server.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,8 +49,12 @@ export const MAX_COMMENTS_LIMIT = 1000;
*/
export function parseLimit(raw: string | null, defaultLimit: number, maxLimit: number): number {
if (raw === null) return defaultLimit;
// Only a decimal-digit spelling is honoured (#2971): Number() coercion
// re-admits every spelling it accepts ('1e2', '0x10', '5.0', '+5', ' 5'),
// which is the #1547 residual this gate exists to close.
if (!/^[0-9]+$/.test(raw)) return defaultLimit;
const n = Number(raw);
if (!Number.isInteger(n) || n < 1) return defaultLimit;
if (n < 1) return defaultLimit;
return Math.min(n, maxLimit);
}

Expand Down
15 changes: 13 additions & 2 deletions pm-stack/projector/test/limit.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,6 +105,17 @@ describe("parseLimit", () => {
}
});

test("coercible non-decimal spellings fall back to the default (#2971)", () => {
for (const raw of ["1e2", "0x10", "5.0", "+5", " 5", "5 "]) {
expect(parseLimit(raw, DEFAULT_ITEMS_LIMIT, MAX_ITEMS_LIMIT)).toBe(DEFAULT_ITEMS_LIMIT);
expect(parseLimit(raw, DEFAULT_COMMENTS_LIMIT, MAX_COMMENTS_LIMIT)).toBe(DEFAULT_COMMENTS_LIMIT);
}
expect(parseLimit("5", DEFAULT_ITEMS_LIMIT, MAX_ITEMS_LIMIT)).toBe(5);
expect(parseLimit("5", DEFAULT_COMMENTS_LIMIT, MAX_COMMENTS_LIMIT)).toBe(5);
expect(parseLimit("99999", DEFAULT_ITEMS_LIMIT, MAX_ITEMS_LIMIT)).toBe(MAX_ITEMS_LIMIT);
expect(parseLimit("99999", DEFAULT_COMMENTS_LIMIT, MAX_COMMENTS_LIMIT)).toBe(MAX_COMMENTS_LIMIT);
});

test("over-max values clamp to the named per-endpoint maximum", () => {
expect(parseLimit("999999999", DEFAULT_ITEMS_LIMIT, MAX_ITEMS_LIMIT)).toBe(MAX_ITEMS_LIMIT);
expect(parseLimit("1001", DEFAULT_COMMENTS_LIMIT, MAX_COMMENTS_LIMIT)).toBe(MAX_COMMENTS_LIMIT);
Expand All @@ -120,8 +131,8 @@ describe("read API limit handling", () => {
});

test("GET /items with an invalid limit never 500s and stays bounded by the default", async () => {
for (const raw of ["-1", "0", "2.7", "abc"]) {
const { status, body } = await get(`/items?limit=${raw}`);
for (const raw of ["-1", "0", "2.7", "abc", "1e2", "0x10", "5.0", "+5"]) {
const { status, body } = await get(`/items?limit=${encodeURIComponent(raw)}`);
expect(status).toBe(200);
// 8 seeded items < default 200, so the default-bounded result is all 8;
// parseLimit's unit tests pin that the bound itself is the default.
Expand Down