Skip to content

fix(security): prevent DoS by bounding pagination limit in getTasks#1595

Open
Abhishek2005-ard wants to merge 39 commits into
aryandas2911:mainfrom
Abhishek2005-ard:fix/unbounded-pagination-limit
Open

fix(security): prevent DoS by bounding pagination limit in getTasks#1595
Abhishek2005-ard wants to merge 39 commits into
aryandas2911:mainfrom
Abhishek2005-ard:fix/unbounded-pagination-limit

Conversation

@Abhishek2005-ard

Copy link
Copy Markdown
Contributor

Overview

This PR resolves an Application Denial of Service (DoS) vulnerability in the getTasks endpoint. Previously, the limit query parameter was unbounded, allowing an attacker to request an excessively large number of tasks (e.g., ?limit=1000000). This could exhaust server memory and database resources.

Changes Made

  • Introduced a MAX_TASK_LIMIT constant set to 100.
  • Wrapped the pagination limit parsed from the query parameter in Math.min(..., MAX_TASK_LIMIT) to strictly enforce the upper boundary while still maintaining the existing MIN_TASK_LIMIT.

Testing Performed

  • Verified that requesting ?limit=500 accurately caps the returned records to 100 and no longer attempts an unbounded query.
  • Confirmed that standard limits (e.g., ?limit=10) continue to operate as expected.

close #1567

Abhishek2005-ard and others added 30 commits May 27, 2026 14:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Security] Unbounded pagination limit in getTasks can lead to Application Denial of Service (DoS)

2 participants