It is possible to pass a negative value via page_size in CursorPagination

[adamlitz]

django-rest-framework/rest_framework/pagination.py

Line 607 in 580bf45

if not self.page_size:

When used against queryset, it will raise the AssertionError, because querysets don't support negative slicing. I think validation is missing if it's less than 0.

[lovelydinosaur]

So the preceding line self.page_size = self.get_page_size(request) always returns either a positive integer or None.

(Unless you've overridden get_page_size to behave differently.)

[adamlitz]

@tomchristie
Indeed, I used my own implementation of get_page_size where I didn't check if page_szie is a negative number. Thank you for your answer. :)