Go version
go version go1.25.6 darwin/arm64
Output of go env in your module/workspace:
AR='ar'
CC='clang'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='clang++'
GCCGO='gccgo'
GO111MODULE=''
GOARCH='arm64'
GOARM64='v8.0'
GOAUTH='netrc'
GOBIN='/Users/mac/go/bin'
GOCACHE='/Users/mac/Library/Caches/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/Users/mac/Library/Application Support/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -arch arm64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -ffile-prefix-map=/var/folders/66/63zhln_s7wz_fn6wsbh3t2000000gn/T/go-build4005551914=/tmp/go-build -gno-record-gcc-switches -fno-common'
GOHOSTARCH='arm64'
GOHOSTOS='darwin'
GOINSECURE=''
GOMOD='/dev/null'
GOMODCACHE='/Users/mac/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='darwin'
GOPATH='/Users/mac/go'
GOPRIVATE=''
GOPROXY=''
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/Users/mac/Library/Application Support/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/darwin_arm64'
GOVCS=''
GOVERSION='go1.25.6'
GOWORK=''
PKG_CONFIG='pkg-config'
What did you do?
The /uploads endpoint uses a default limit of 1000 when the limit query parameter is omitted:
limit := 1000
limitStr := r.Form.Get("limit")
if limitStr != "" {
var err error
limit, err = strconv.Atoi(limitStr)
if err != nil {
http.Error(w, "invalid limit parameter", http.StatusBadRequest)
return
}
}I sent a request with an explicit zero limit:
For example:
curl -i 'http://localhost:8080/uploads?limit=0'
The parsed value is passed to DB.ListUploads. The database layer only adds a SQL LIMIT clause for non-zero values:
if limit != 0 {
query += fmt.Sprintf(" LIMIT %d", limit)
}A negative value can also be supplied:
curl -i 'http://localhost:8080/uploads?limit=-1'
This generates SQL containing:
What did you see happen?
limit=0 is accepted and passed to the database layer. Because zero causes the SQL LIMIT clause to be omitted, the request returns all matching uploads instead of the default maximum of 1000.
limit=-1 is also accepted. Its behavior is database-dependent: it may produce a SQL error or be interpreted as an unlimited query.
This allows a caller to bypass the endpoint's default result limit.
What did you expect to see?
An explicitly provided limit should be required to be a positive integer.
Both of these requests should return 400 Bad Request:
GET /uploads?limit=0
GET /uploads?limit=-1
A positive limit should continue to work normally:
and return only the most recent upload.
Go version
go version go1.25.6 darwin/arm64
Output of
go envin your module/workspace:What did you do?
The
/uploadsendpoint uses a default limit of 1000 when thelimitquery parameter is omitted:I sent a request with an explicit zero limit:
For example:
curl -i 'http://localhost:8080/uploads?limit=0'The parsed value is passed to
DB.ListUploads. The database layer only adds a SQLLIMITclause for non-zero values:A negative value can also be supplied:
curl -i 'http://localhost:8080/uploads?limit=-1'This generates SQL containing:
What did you see happen?
limit=0is accepted and passed to the database layer. Because zero causes the SQLLIMITclause to be omitted, the request returns all matching uploads instead of the default maximum of 1000.limit=-1is also accepted. Its behavior is database-dependent: it may produce a SQL error or be interpreted as an unlimited query.This allows a caller to bypass the endpoint's default result limit.
What did you expect to see?
An explicitly provided
limitshould be required to be a positive integer.Both of these requests should return
400 Bad Request:A positive limit should continue to work normally:
and return only the most recent upload.