From e0b56b7495e809581a1e6447794bf7573a78af56 Mon Sep 17 00:00:00 2001
From: Chocobozzz <me@florianbigard.com>
Date: Thu, 9 Jan 2020 09:36:31 +0100
Subject: [PATCH] Return an error on invalid count pagination

---
 server/initializers/constants.ts                    | 13 ++++++++++---
 server/middlewares/pagination.ts                    |  4 +---
 .../validators/activitypub/pagination.ts            |  9 +++++++--
 server/middlewares/validators/pagination.ts         |  9 +++++++--
 shared/extra-utils/requests/check-api-params.ts     | 12 ++++++++++--
 5 files changed, 35 insertions(+), 12 deletions(-)

diff --git a/server/initializers/constants.ts b/server/initializers/constants.ts
index f4a2b358b..8461c7320 100644
--- a/server/initializers/constants.ts
+++ b/server/initializers/constants.ts
@@ -22,9 +22,16 @@ const API_VERSION = 'v1'
 const PEERTUBE_VERSION = require(join(root(), 'package.json')).version
 
 const PAGINATION = {
-  COUNT: {
-    DEFAULT: 15,
-    MAX: 100
+  GLOBAL: {
+    COUNT: {
+      DEFAULT: 15,
+      MAX: 100
+    }
+  },
+  OUTBOX: {
+    COUNT: {
+      MAX: 50
+    }
   }
 }
 
diff --git a/server/middlewares/pagination.ts b/server/middlewares/pagination.ts
index 043869303..b59717d7b 100644
--- a/server/middlewares/pagination.ts
+++ b/server/middlewares/pagination.ts
@@ -5,11 +5,9 @@ function setDefaultPagination (req: express.Request, res: express.Response, next
   if (!req.query.start) req.query.start = 0
   else req.query.start = parseInt(req.query.start, 10)
 
-  if (!req.query.count) req.query.count = PAGINATION.COUNT.DEFAULT
+  if (!req.query.count) req.query.count = PAGINATION.GLOBAL.COUNT.DEFAULT
   else req.query.count = parseInt(req.query.count, 10)
 
-  if (req.query.count > PAGINATION.COUNT.MAX) req.query.count = PAGINATION.COUNT.MAX
-
   return next()
 }
 
diff --git a/server/middlewares/validators/activitypub/pagination.ts b/server/middlewares/validators/activitypub/pagination.ts
index 8b32d3415..fa21f063d 100644
--- a/server/middlewares/validators/activitypub/pagination.ts
+++ b/server/middlewares/validators/activitypub/pagination.ts
@@ -2,10 +2,15 @@ import * as express from 'express'
 import { query } from 'express-validator'
 import { logger } from '../../../helpers/logger'
 import { areValidationErrors } from '../utils'
+import { PAGINATION } from '@server/initializers/constants'
 
 const apPaginationValidator = [
-  query('page').optional().isInt({ min: 1 }).withMessage('Should have a valid page number'),
-  query('size').optional().isInt({ max: 50 }).withMessage('Should have a valid page size (max: 50)'),
+  query('page')
+    .optional()
+    .isInt({ min: 1 }).withMessage('Should have a valid page number'),
+  query('size')
+    .optional()
+    .isInt({ min: 0, max: PAGINATION.OUTBOX.COUNT.MAX }).withMessage(`Should have a valid page size (max: ${PAGINATION.OUTBOX.COUNT.MAX})`),
 
   (req: express.Request, res: express.Response, next: express.NextFunction) => {
     logger.debug('Checking pagination parameters', { parameters: req.query })
diff --git a/server/middlewares/validators/pagination.ts b/server/middlewares/validators/pagination.ts
index 80ae57c0b..1cae7848c 100644
--- a/server/middlewares/validators/pagination.ts
+++ b/server/middlewares/validators/pagination.ts
@@ -2,10 +2,15 @@ import * as express from 'express'
 import { query } from 'express-validator'
 import { logger } from '../../helpers/logger'
 import { areValidationErrors } from './utils'
+import { PAGINATION } from '@server/initializers/constants'
 
 const paginationValidator = [
-  query('start').optional().isInt({ min: 0 }).withMessage('Should have a number start'),
-  query('count').optional().isInt({ min: 0 }).withMessage('Should have a number count'),
+  query('start')
+    .optional()
+    .isInt({ min: 0 }).withMessage('Should have a number start'),
+  query('count')
+    .optional()
+    .isInt({ min: 0, max: PAGINATION.GLOBAL.COUNT.MAX }).withMessage(`Should have a number count (max: ${PAGINATION.GLOBAL.COUNT.MAX})`),
 
   (req: express.Request, res: express.Response, next: express.NextFunction) => {
     logger.debug('Checking pagination parameters', { parameters: req.query })
diff --git a/shared/extra-utils/requests/check-api-params.ts b/shared/extra-utils/requests/check-api-params.ts
index a2a549682..c34c7c216 100644
--- a/shared/extra-utils/requests/check-api-params.ts
+++ b/shared/extra-utils/requests/check-api-params.ts
@@ -11,14 +11,22 @@ function checkBadStartPagination (url: string, path: string, token?: string, que
   })
 }
 
-function checkBadCountPagination (url: string, path: string, token?: string, query = {}) {
-  return makeGetRequest({
+async function checkBadCountPagination (url: string, path: string, token?: string, query = {}) {
+  await makeGetRequest({
     url,
     path,
     token,
     query: immutableAssign(query, { count: 'hello' }),
     statusCodeExpected: 400
   })
+
+  await makeGetRequest({
+    url,
+    path,
+    token,
+    query: immutableAssign(query, { count: 2000 }),
+    statusCodeExpected: 400
+  })
 }
 
 function checkBadSortPagination (url: string, path: string, token?: string, query = {}) {
-- 
2.41.0