Merge pull request #9800 from vegaprotocol/9408-overflow

fix: pagination enforce range
vegaprotocol · Oct 16, 2023 · 1360d8b · 1360d8b
2 parents 1fbfa68 + e1d1104
commit 1360d8b
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 4 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -14,6 +14,7 @@
 - [9719](https://github.com/vegaprotocol/vega/issues/9719) - Remove unnecessary fields from referral and volume discount program proposals.
 - [9733](https://github.com/vegaprotocol/vega/issues/9733) - Making `set_id` optional in `referral set stats` endpoint
 - [9743](https://github.com/vegaprotocol/vega/issues/9743) - Rename `ReferralFeeStats` endpoints to `FeesStats`, and `FeeStats` event to `FeesStats`.
+- [9408](https://github.com/vegaprotocol/vega/issues/9408) - Enforce pagination range.
 
 ### 🗑️ Deprecation
 

diff --git a/datanode/entities/pagination.go b/datanode/entities/pagination.go
@@ -120,7 +120,7 @@ func CursorPaginationFromProto(cp *v2.Pagination) (CursorPagination, error) {
 	}
 
 	if cp.First != nil {
-		if *cp.First < 0 {
+		if *cp.First < 0 || *cp.First > defaultPageSize {
 			return CursorPagination{}, ErrCursorOverflow
 		}
 		forwardOffset = &offset{
@@ -135,7 +135,7 @@ func CursorPaginationFromProto(cp *v2.Pagination) (CursorPagination, error) {
 			forwardOffset.Cursor = &after
 		}
 	} else if cp.Last != nil {
-		if *cp.Last < 0 {
+		if *cp.Last < 0 || *cp.Last > defaultPageSize {
 			return CursorPagination{}, ErrCursorOverflow
 		}
 		backwardOffset = &offset{
@@ -228,8 +228,8 @@ func validatePagination(pagination CursorPagination) error {
 	}
 
 	limit := *cursorOffset.Limit
-	if limit <= 0 {
-		return errors.New("pagination limit must be greater than 0")
+	if limit <= 0 || limit > defaultPageSize {
+		return errors.Errorf("pagination limit must be in range 0-%d", defaultPageSize)
 	}
 
 	return nil