Backend: assets list endpoint has no LIMIT cap — ?limit=999999999 OOMs the API #119

New issue

Closed

opened 2026-05-26 18:21:13 -04:00 by zgaetano · 1 comment

zgaetano commented

2026-05-26 18:21:13 -04:00

Owner

Fixed in 04ce096. GET /api/v1/assets clamps limit to MAX_LIMIT = 500 and sanitises both limit / offset to integers, defaulting to 50 / 0 on bogus input.

Fixed in 04ce096. `GET /api/v1/assets` clamps `limit` to `MAX_LIMIT = 500` and sanitises both `limit` / `offset` to integers, defaulting to 50 / 0 on bogus input.

~~zgaetano referenced this issue 2026-05-26 18:22:49 -04:00~~

Tracker: 2026-05-26 audit session — 27 bugs logged (#100-#127) #128

zgaetano commented

2026-05-26 19:34:06 -04:00

Author

Owner

Fix Plan — #119 Assets list endpoint has no LIMIT cap

Root cause: assets.js:92-93 passes req.query.limit directly into SQL LIMIT without max cap. ?limit=999999999 → PG allocates gigantic result set → OOM.

Fix — clamp on all list endpoints:

// before:
const limit = parseInt(req.query.limit, 10) || 50;

// after:
const limit = Math.min(parseInt(req.query.limit, 10) || 50, 200);

Apply to: assets.js, recorders.js, projects.js, bins.js, schedules.js, groups.js, users.js — every endpoint accepting ?limit.

Files: All route files with list endpoints
Effort: ~30min
**Priority: P2 — DoS vector

## Fix Plan — #119 Assets list endpoint has no LIMIT cap **Root cause:** `assets.js:92-93` passes `req.query.limit` directly into SQL `LIMIT` without max cap. `?limit=999999999` → PG allocates gigantic result set → OOM. **Fix — clamp on all list endpoints:** ```js // before: const limit = parseInt(req.query.limit, 10) || 50; // after: const limit = Math.min(parseInt(req.query.limit, 10) || 50, 200); ``` Apply to: `assets.js`, `recorders.js`, `projects.js`, `bins.js`, `schedules.js`, `groups.js`, `users.js` — every endpoint accepting `?limit`. **Files:** All route files with list endpoints **Effort:** ~30min **Priority: P2 — DoS vector

zgaetano referenced this issue from a commit

2026-05-26 22:06:25 -04:00

chore: 1.2 ship-prep sweep — close 38 issues

zgaetano closed this issue

2026-05-26 22:08:31 -04:00