davide/ecommerce-platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): clamp pagination parameters to prevent negative or overflow values

Browse Source 
Replace raw parseInt() with Math.max/min bounds: page >= 1, limit 1-100.
Affects public products, admin orders, and admin reviews endpoints.
This commit is contained in:
Davide Grilli
2026-05-19 10:12:11 +02:00
parent e18bc8fbda
commit 43a3efc94f
3 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/src/app/api/admin/orders/route.ts
+2 -2
View File
@@ -13,8 +13,8 @@ export async function GET(request: NextRequest) {
if (!user) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
const { searchParams } = new URL(request.url)
const page = parseInt(searchParams.get('page') || '1')
const limit = parseInt(searchParams.get('limit') || '20')
const page = Math.max(1, parseInt(searchParams.get('page') || '1') || 1)
const limit = Math.min(100, Math.max(1, parseInt(searchParams.get('limit') || '20') || 20))
const status = searchParams.get('status')
const skip = (page - 1) * limit
app/src/app/api/admin/reviews/route.ts
+2 -2
View File
@@ -13,8 +13,8 @@ export async function GET(request: NextRequest) {
if (!user) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
const { searchParams } = new URL(request.url)
const page = parseInt(searchParams.get('page') || '1')
const limit = parseInt(searchParams.get('limit') || '20')
const page = Math.max(1, parseInt(searchParams.get('page') || '1') || 1)
const limit = Math.min(100, Math.max(1, parseInt(searchParams.get('limit') || '20') || 20))
const status = searchParams.get('status')
const skip = (page - 1) * limit
app/src/app/api/products/route.ts
+2 -2
View File
@@ -3,8 +3,8 @@ import { prisma } from '@/lib/prisma'
export async function GET(request: NextRequest) {
const { searchParams } = new URL(request.url)
const page = parseInt(searchParams.get('page') || '1')
const limit = parseInt(searchParams.get('limit') || '20')
const page = Math.max(1, parseInt(searchParams.get('page') || '1') || 1)
const limit = Math.min(100, Math.max(1, parseInt(searchParams.get('limit') || '20') || 20))
const category = searchParams.get('category')
const search = searchParams.get('search')