From abe3d4b900452ab4776e37cfe14d9d74a8f43896 Mon Sep 17 00:00:00 2001 From: lorentz Date: Wed, 15 Jul 2026 22:25:29 -0400 Subject: [PATCH] fix(18-04): clamp campaigns list limit param to [0, 200] (WR-02) - Parse limit once with Number.isFinite instead of `|| 50`, so an explicit limit=0 is honored instead of silently replaced by the default - Math.max/min clamps to [0, 200], preventing a negative limit from reaching the SQL LIMIT clause and raising an unhandled 500 --- app/api/phishing/campaigns/route.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/app/api/phishing/campaigns/route.ts b/app/api/phishing/campaigns/route.ts index 56e8c04..aac35d2 100644 --- a/app/api/phishing/campaigns/route.ts +++ b/app/api/phishing/campaigns/route.ts @@ -28,7 +28,8 @@ export async function GET(request: NextRequest) { try { const url = request.nextUrl; - const limit = Math.min(parseInt(url.searchParams.get('limit') ?? '50', 10) || 50, 200); + const rawLimit = parseInt(url.searchParams.get('limit') ?? '50', 10); + const limit = Math.min(Math.max(Number.isFinite(rawLimit) ? rawLimit : 50, 0), 200); const offset = Math.max(parseInt(url.searchParams.get('offset') ?? '0', 10) || 0, 0); const status = url.searchParams.get('status');