diff options
| author | grm <grm@eyesin.space> | 2026-09-18 13:49:53 +0300 |
|---|---|---|
| committer | grm <grm@eyesin.space> | 2026-09-18 13:49:53 +0300 |
| commit | c47397ac1e2ceafafe2be3cdec86366dd396ed6f (patch) | |
| tree | 72474c50ed5ffc75595445bef72ac6c340922cc1 /internal/db/migrations/blog/git@git.eyesin.space: | |
| parent | d23fe805546e992c8033d64d7177fe1454ad7716 (diff) | |
| download | blogspace-c47397ac1e2ceafafe2be3cdec86366dd396ed6f.tar.gz blogspace-c47397ac1e2ceafafe2be3cdec86366dd396ed6f.tar.bz2 blogspace-c47397ac1e2ceafafe2be3cdec86366dd396ed6f.zip | |
Security: Clamp page numbers so a huge ?p= cannot overflow the offset
?p=9223372036854775807 made (n-1)*per wrap negative, Postgres refused
the OFFSET and every listing, tag and search page answered 500 — a
line in the log per request for any bot fuzzing query strings. Page
numbers now stop at 100000.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sd8UPWrvyYCLj97JexNw3A
Diffstat (limited to 'internal/db/migrations/blog/git@git.eyesin.space:')
0 files changed, 0 insertions, 0 deletions