[ghazy2001]

Summary

Fixes #3567
Linear: CAP-957

Opening /dashboard/caps?page=-1, /dashboard/caps?page=1.5, or /dashboard/spaces/[spaceId]?limit=2.5 resulted in a client-side exception crash due to invalid MySQL LIMIT and OFFSET syntax.

Root Cause

Both apps/web/app/(org)/dashboard/caps/page.tsx and apps/web/app/(org)/dashboard/spaces/[spaceId]/page.tsx parsed page and limit using Number(searchParams.page) || 1 and Number(searchParams.limit) || 15.
Negative (-1) and fractional (1.5, 2.5) numbers are truthy, passing through into the query's OFFSET (page - 1) * limit and LIMIT limit without being validated as positive integers.

Changes

• Created apps/web/lib/pagination.ts providing parsePageParam and parseLimitParam to validate that page and limit inputs are integers ≥ 1, with bounds and default values.
• Refactored parsePublicCollectionPage in apps/web/lib/public-collections-policy.ts to delegate to parsePageParam.
• Replaced unvalidated Number(...) parsing in CapsPage and SharedCapsPage with parsePageParam and parseLimitParam.
• Added unit tests in apps/web/__tests__/unit/pagination-params.test.ts verifying missing, empty, zero, negative, fractional, array, and oversized inputs.

Test plan

• Ran unit tests with Bun:
  • bun test apps/web/__tests__/unit/pagination-params.test.ts (6 pass, 23 assertions)
  • bun test apps/web/__tests__/unit/activity-time-ago.test.ts (3 pass, 13 assertions)
  • bun test apps/web/__tests__/unit/video-thumbnail-duration.test.ts (4 pass, 17 assertions)
• Verified page=-1 or page=1.5 cleanly falls back to page 1 instead of throwing syntax errors in SQL queries.

Confidence Score: 4/5

Bound page values before merging so oversized inputs cannot still break dashboard queries.

Findings

1.  Large pages still fail ▶
2.  Next repeats the first page ▶

Fix with agent prompt

### Issue 1
apps/web/lib/pagination.ts:8
`parsePageParam` accepts enormous pages such as `1e308`. With the default limit of 15, `(page - 1) * limit` becomes `Infinity`, which both dashboards pass to `.offset()`. That cannot be a valid MySQL offset, so a crafted URL can still make the dashboard query fail. Bound the page so the calculated offset stays within a safe integer range, and add a test for oversized pages.

### Issue 2
apps/web/app/(org)/dashboard/caps/page.tsx:137
The server now falls back to page 1 for fractional values, but `Caps` and `SharedCaps` still read the raw page with `Number(...) || 1`. Opening `?page=1.5` shows page 1's videos while marking page 1.5 as current. The next link points to page 2.5, which again loads page 1. Use the same parser in both clients, or pass the parsed page from the server.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Adds shared helpers to check dashboard page and limit values.

• Dashboard pages use checked URL values for pagination.

_{Reviews (1) · Last reviewed commit: "fix(web): validate page and limit query ..." · Reviewed by Greptile}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
cap-status	Skipped		Oct 29, 2026 10:14pm UTC

[greptile-apps]

Large pages still fail

parsePageParam accepts enormous pages such as 1e308. With the default limit of 15, (page - 1) * limit becomes Infinity, which both dashboards pass to .offset(). That cannot be a valid MySQL offset, so a crafted URL can still make the dashboard query fail. Bound the page so the calculated offset stays within a safe integer range, and add a test for oversized pages.

Prompt To Fix With AI

This is a comment left during a code review.
Path: apps/web/lib/pagination.ts
Line: 8

Comment:
**Large pages still fail**

`parsePageParam` accepts enormous pages such as `1e308`. With the default limit of 15, `(page - 1) * limit` becomes `Infinity`, which both dashboards pass to `.offset()`. That cannot be a valid MySQL offset, so a crafted URL can still make the dashboard query fail. Bound the page so the calculated offset stays within a safe integer range, and add a test for oversized pages.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Next repeats the first page

The server now falls back to page 1 for fractional values, but Caps and SharedCaps still read the raw page with Number(...) || 1. Opening ?page=1.5 shows page 1's videos while marking page 1.5 as current. The next link points to page 2.5, which again loads page 1. Use the same parser in both clients, or pass the parsed page from the server.

Prompt To Fix With AI

This is a comment left during a code review.
Path: apps/web/app/(org)/dashboard/caps/page.tsx
Line: 137

Comment:
**Next repeats the first page**

The server now falls back to page 1 for fractional values, but `Caps` and `SharedCaps` still read the raw page with `Number(...) || 1`. Opening `?page=1.5` shows page 1's videos while marking page 1.5 as current. The next link points to page 2.5, which again loads page 1. Use the same parser in both clients, or pass the parsed page from the server.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.