ExportXMLWordPrintable

    • Type: Bug
    • Resolution: Unresolved
    • Priority: Normal
    • None
    • Affects Version/s: None
    • Component/s: Quick Fix
    • None

      Problem

      Navigating to a revision page with an integer ID larger than PostgreSQL's max
      integer value (2,147,483,647) causes a raw SQL error to be displayed to the user
      instead of a friendly error page.

      Steps to reproduce

      1. Go to /revision/2701545454 (any number > 2,147,483,647)
      2. Observe: the page shows a raw 500 error with the SQL message:
      select "bookbrainz"."revision".* from "bookbrainz"."revision" 
      where "bookbrainz"."revision"."id" = $1 limit $2 
      — value "2701545454" is out of range for type integer
      

      Expected behaviour

      A user-friendly 400 Bad Request or 404 Not Found page, similar to what happens
      when a non-numeric string is passed.

      Root cause

      The checkValidRevisionId middleware in src/server/helpers/middleware.ts
      only checks that the ID is a positive integer. It does not check against
      PostgreSQL's max integer bound (2,147,483,647), so oversized values pass
      validation and reach the database query, which then throws an uncaught error.

      Proposed fix

      Add a bounds check in checkValidRevisionId:

      const MAX_PG_INT = 2147483647;
      if (!_.isInteger(idToNumber) || idToNumber <= 0 || idToNumber > MAX_PG_INT) {
          return next(new error.BadRequestError(`Invalid revision id: ${req.params.id}`, req));
      }
      

            Assignee:
            GARV THAKRE
            Reporter:
            GARV THAKRE
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:

                Version Package