From 7f8b8981057665c3722370a8aa187834d0fafac0 Mon Sep 17 00:00:00 2001
From: John O'Keefe <jrokeefe@protonmail.com>
Date: Thu, 29 Jan 2026 08:51:30 -0500
Subject: [PATCH] fix: add pagination limits and validation

- Enforce maximum pagination limit of 1000 items per request
- Prevent negative offset values in pagination
- Apply limits to both /api/ebooks and /api/media-items endpoints
- Protect against DoS attacks from large limit values

Fixes security issue: No maximum pagination limit
---
 internal/handlers/ebook.go | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/internal/handlers/ebook.go b/internal/handlers/ebook.go
index 56f7aba..4010b6b 100644
--- a/internal/handlers/ebook.go
+++ b/internal/handlers/ebook.go
@@ -15,6 +15,10 @@ import (
 	"github.com/labstack/echo/v4"
 )
 
+const (
+	maxPaginationLimit = 1000
+)
+
 type Handler struct {
 	db      *database.Queries
 	scanner *services.EbookScanner
@@ -120,12 +124,19 @@ func (h *Handler) ListEbooks(c echo.Context) error {
 	if limitStr != "" {
 		if l, err := strconv.Atoi(limitStr); err == nil {
 			limit = int32(l)
+			// Enforce maximum limit
+			if limit > maxPaginationLimit {
+				limit = maxPaginationLimit
+			}
 		}
 	}
 
 	offset := int32(0)
 	if offsetStr != "" {
 		if o, err := strconv.Atoi(offsetStr); err == nil {
+			if o < 0 {
+				return c.JSON(http.StatusBadRequest, map[string]string{"error": "offset cannot be negative"})
+			}
 			offset = int32(o)
 		}
 	}
@@ -590,6 +601,15 @@ func (h *Handler) ListMediaItems(c echo.Context) error {
 		limit = 50
 	}
 
+	// Enforce maximum limit
+	if limit > maxPaginationLimit {
+		limit = maxPaginationLimit
+	}
+
+	if offset < 0 {
+		return c.JSON(http.StatusBadRequest, map[string]string{"error": "offset cannot be negative"})
+	}
+
 	if libraryID != "" {
 		libUUID, err := uuid.Parse(libraryID)
 		if err != nil {