Skip to content

Validate GitHub pagination cursors in internal/github/list.go #121

Description

@Jagadeeshftw

📌 Description

internal/github/list.go handles paginated GitHub API listing (issues, PRs, etc.), but if the cursor/page-link parsing doesn't validate the returned Link header format defensively, a malformed or unexpected response from GitHub could cause an infinite pagination loop or a panic.

🧩 Requirements and context

  • Add defensive parsing/validation of the Link header used to find the 'next' page.
  • Cap the maximum number of pages followed per call as a safety net against infinite loops.
  • Return a typed error on malformed pagination data instead of panicking.

🛠️ Suggested execution

  • Review the pagination-following logic in internal/github/list.go.
  • Add a max-page-count guard and a parse-failure typed error.
  • Add a test with a malformed Link header asserting graceful failure, not a loop/panic.

✅ Acceptance criteria

  • Malformed Link headers produce a typed error, not a panic or infinite loop.
  • A hard page-count cap exists as defense in depth.
  • Existing well-formed pagination continues to work.

🔒 Security notes

Defends against a misbehaving or compromised upstream (GitHub API proxy/cache) causing resource exhaustion via unbounded pagination.

📋 Guidelines

  • Minimum 95% test coverage
  • Clear documentation
  • Timeframe: 96 hours

Metadata

Metadata

Assignees

Labels

GrantFox OSSGrantFox open-source programMaybe RewardedGrantFox: potentially rewarded contributionOfficial Campaign | FWC26GrantFox official campaign issuebackendBackend / API work

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions