Skip to content

Developer API video list returns 500 for fractional or oversized limit/offset #3568

Description

@AryaKesharwani

Description

GET /api/developer/v1/videos returns 500 Internal Server Error when limit or offset is fractional or larger than MySQL accepts.

videos.ts clamps limit to 100 and offset to ≥0 but never rounds them or bounds offset, so the raw value reaches the SQL LIMIT/OFFSET and MySQL rejects it ("You have an error in your SQL syntax ... near '5.5'").

Query Status
(none) / limit=5 200
limit=5.5 500
offset=2.5 500
offset=99999999999999999999 500

Reproduction

curl -H "Authorization: Bearer csk_..." "https://<host>/api/developer/v1/videos?limit=5.5"

Expected: a normal page of results (or a 400). Actual: 500.

Additional Context

  • Cap version: web, main at 197db2b
  • Reproduced in a local self-hosted web build. apps/web/app/api/developer/v1/[...route]/videos.ts:17-18.

Activity

  1. linear commented on Oct 29, 2026

    @linear
  2. ghazy2001 commented on Oct 29, 2026

    @ghazy2001
    Contributor

    I've submitted PR #3576 to validate, floor, and bound limit and offset pagination parameters with unit tests.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions