Location: ./src/common/helpers/utils.ts

Function: getNextEnabledAndResultsArray

Impact: This utility function is widely used across the BookBrainz site, specifically in:

• Search results

• Revisions

• Collections

• Admin logs and the Admin panel

The Problem: The function uses a while loop to truncate an array based on the size parameter. The loop condition is while (array.length > size). If a negative value is passed as size (for example, by a user manually tampering with the ?size= URL parameter), the loop becomes infinite.

When the array becomes empty, array.pop() returns undefined and array.length remains 0. Since 0 is always greater than any negative number, the loop never terminates. This causes the Node.js server process to hang during SSR (Server-Side Rendering).

Steps to Reproduce:
1. Navigate to any page using this utility (e.g., a search results page).

2. Manually change the size value in the URL from a positive number to a negative number (e.g., change ?size=20 to ?size=-1).

3. The Node.js event loop will become completely blocked by the infinite loop. This results in a permanent server-side hang that prevents the server from processing any further requests for any user until the process is manually terminated or restarted.

The Fix:
1. Use Math.max(0, size) to ensure the truncation limit is never negative.

2. Replace the imperative while loop with Array.prototype.slice() to avoid manual loop logic and array mutation.