-
Type:
Bug
-
Resolution: Unresolved
-
Priority:
Normal
-
None
-
Affects Version/s: None
-
Component/s: Quick Fix
-
None
Problem
Navigating to a revision page with an integer ID larger than PostgreSQL's max
integer value (2,147,483,647) causes a raw SQL error to be displayed to the user
instead of a friendly error page.
Steps to reproduce
- Go to /revision/2701545454 (any number > 2,147,483,647)
- Observe: the page shows a raw 500 error with the SQL message:
select "bookbrainz"."revision".* from "bookbrainz"."revision" where "bookbrainz"."revision"."id" = $1 limit $2 — value "2701545454" is out of range for type integer
Expected behaviour
A user-friendly 400 Bad Request or 404 Not Found page, similar to what happens
when a non-numeric string is passed.
Root cause
The checkValidRevisionId middleware in src/server/helpers/middleware.ts
only checks that the ID is a positive integer. It does not check against
PostgreSQL's max integer bound (2,147,483,647), so oversized values pass
validation and reach the database query, which then throws an uncaught error.
Proposed fix
Add a bounds check in checkValidRevisionId:
const MAX_PG_INT = 2147483647; if (!_.isInteger(idToNumber) || idToNumber <= 0 || idToNumber > MAX_PG_INT) { return next(new error.BadRequestError(`Invalid revision id: ${req.params.id}`, req)); }