limit/offset query params not validated — NaN risk

[gzoonet]

Security Audit — Issue 13 of 15

Severity: Low
File: packages/server/src/routes/entities.ts:12

Description

Number('foo') yields NaN. The limit and offset query parameters are converted with Number() but never validated. SQLite with LIMIT NaN may throw or silently misbehave.

Verified

✅ Confirmed — direct Number() conversion without bounds or type checks. No validation middleware on numeric query params.

Suggested Fix

• Validate and clamp numeric params: Math.max(1, Math.min(Number(limit) || 50, 1000))
• Or use Zod schema validation on the query parameters

Source

From a community security review on Reddit:
https://www.reddit.com/r/ClaudeAI/comments/1rm4avi/built_an_mcp_server_that_gives_claude_code_access/

[gzoonet]

Fixed in v0.5.7 (commit 433de80)

• All limit/offset query params across all routes now use NaN-safe parsing with Number(x) || default
• Values are clamped to valid ranges (e.g., limit: 1–500, graph limit: 1–10000)
• Previously fixed in entities route (v0.5.6), now applied to: contradictions, relationships, status/graph

Published to npm: npm install gzoo-cortex@0.5.7