[3.x] Validate page query parameter in SupportPagination

[pkoury]

1️⃣ Is this something that is wanted/needed? Did you create a discussion about it first?

Yes. Production 500 on PHP 8.5 triggered by a Bingbot crawl of a WithPagination page with an overflow-large ?page= value. No prior discussion. The regression is described in section 5️⃣ below.

2️⃣ Did you create a branch for your fix/feature?

Yes. fix/pagination-page-overflow-3x off 3.x.

3️⃣ Does it contain multiple, unrelated changes?

No. One method changed, one regression test added.

4️⃣ Does it include tests?

Yes. New unit test in src/Features/SupportPagination/UnitTest.php covering overflow-large strings, non-numeric strings, zero, negative numbers, and the happy path. Tests fail on the unfixed 3.x checkout and pass with the fix applied.

5️⃣ Please include a thorough description (including small code snippets if possible) of the improvement and reasons why it's useful.

Problem

On PHP 8.4+, SupportPagination's registered currentPageResolver closure does an unguarded (int) cast on a value sourced from the untrusted ?page= query string. When the value overflows PHP_INT_MAX, the cast throws ErrorException and the request 500s. Search engine crawlers reliably reproduce this in production.

ErrorException: The float 1.2123123123213123E+22 is not representable as an int, cast occurred
at src/Features/SupportPagination/SupportPagination.php:83

Non-numeric strings, zero, and negative numbers are also accepted without validation, which doesn't crash but produces incorrect page numbers downstream.

Fix

Validate inside the resolver closure with FILTER_VALIDATE_INT, falling back to page 1 for invalid, out-of-range, zero, or negative values. Mirrors Laravel's stock currentPageResolver in PaginationState::resolveUsing() line for line.

Paginator::currentPageResolver(function ($pageName) {
    $this->ensurePaginatorIsInitialized($pageName);

    $page = $this->component->paginators[$pageName];

    if (filter_var($page, FILTER_VALIDATE_INT) !== false && (int) $page >= 1) {
        return (int) $page;
    }

    return 1;
});

The validation has to be at the resolver closure (the read point) rather than inside resolvePage(). addUrlHook() registers a PaginationUrl attribute that calls setPropertyFromQueryString(), which overwrites paginators[$pageName] with the raw query string after resolvePage() has returned. Validating at the closure covers both the initial-resolution path and the URL-hook path.

Cursor pagination is unaffected. The CursorPaginator::currentCursorResolver closure passes the value to Cursor::fromEncoded() and never casts to int.

Companion

A matching PR against main will be opened for the same bug in the 4.x line.

[joshhanley]

@pkoury thanks for the PR! I made one small tweak to reassign back to the paginators array once the cast/ reset is done to ensure it's kept up to date.

[pkoury]

Thanks @joshhanley! That makes sense. Appreciate you tightening that up a bit.

[calebporzio]

great ,thanks everyone!