fix(indexer): clamp limit query param to >=1 (negative LIMIT 500) (#284) #740

Merged

Brouie merged 1 commit from qa/284-clamp-negative-limit into main

2026-06-04 08:02:25 +00:00

Brouie commented

2026-06-04 03:13:35 +00:00

(Migrated from gitlab.com)

?limit=-1 / ?limit=0 flowed through q.limit.unwrap_or(D).min(MAX) (limit is Option<i64>) into a parameterized LIMIT $N, which Postgres rejects → 500. Switch the 14 limit clamps to .clamp(1, MAX) so bad input returns a single row instead of a 500.

Sites: traders.rs (5), pairs.rs (7), cg.rs (1), oracle.rs (1 — not in the report's list, same bug). Offsets were already lower-guarded (.max(0) + max-offset 400). The .clamp(1, MAX) pattern already existed in-tree.

cargo check clean.

GitLab #284

`?limit=-1` / `?limit=0` flowed through `q.limit.unwrap_or(D).min(MAX)` (`limit` is `Option<i64>`) into a parameterized `LIMIT $N`, which Postgres rejects → 500. Switch the 14 limit clamps to `.clamp(1, MAX)` so bad input returns a single row instead of a 500. Sites: traders.rs (5), pairs.rs (7), cg.rs (1), oracle.rs (1 — not in the report's list, same bug). Offsets were already lower-guarded (`.max(0)` + max-offset 400). The `.clamp(1, MAX)` pattern already existed in-tree. cargo check clean. GitLab #284

Rows
Columns