Budibase/budibase · error · HTTPError

Invalid limit query

Error message

Invalid limit query

What it means

Thrown by sanitizeLimitQuery when the `limit` query parameter is not a pure digit string. Empty/whitespace-only values fall back to DEFAULT_LIMIT, but any non-numeric value (e.g. 'abc', '10x', '1.5', '-5') fails the /^\d+$/ test and produces this 400 error.

Source

Thrown at packages/server/src/api/controllers/ai/agentRequests.ts:19

import { HTTPError } from "@budibase/backend-core"
import {
  AGENT_REQUEST_STATUSES,
  type AgentRequestStatus,
  type FetchAgentRequestsResponse,
  type UserCtx,
} from "@budibase/types"
import sdk from "../../../sdk"

const DEFAULT_LIMIT = 100

const sanitizeLimitQuery = (limit?: string): number => {
  const normalizedLimit = limit?.trim()
  if (!normalizedLimit) {
    return DEFAULT_LIMIT
  }

  if (!/^\d+$/.test(normalizedLimit)) {
    throw new HTTPError("Invalid limit query", 400)
  }

  const parsedLimit = Number.parseInt(normalizedLimit, 10)
  if (parsedLimit < 1 || parsedLimit > 100) {
    throw new HTTPError("Limit query must be between 1 and 100", 400)
  }

  return parsedLimit
}

const sanitizePageQuery = (page?: string): number => {
  const normalizedPage = page?.trim()
  if (!normalizedPage) {
    return 1
  }

  if (!/^\d+$/.test(normalizedPage)) {
    throw new HTTPError("Invalid page query", 400)

View on GitHub (pinned to a81a902e9a)

Solutions

1. Send only plain integer digits, e.g. ?limit=25
2. Omit the limit parameter to use the default
3. Sanitize client-side: parse and validate the value before building the URL
4. Convert booleans/null to undefined rather than stringifying

Example fix

// before
const url = `/requests?limit=${String(pageSize)}` // pageSize = undefined -> "undefined"
// after
const url = pageSize ? `/requests?limit=${parseInt(pageSize, 10)}` : `/requests`

function sanitizeLimit(limit, { min = 1, max = 100 } = {}) {
  if (limit === undefined || limit === null || String(limit).trim() === "") return undefined
  const s = String(limit).trim()
  if (!/^\d+$/.test(s)) throw new Error("limit must be an integer")
  const n = parseInt(s, 10)
  if (n < min || n > max) throw new Error(`limit must be between ${min} and ${max}`)
  return n
}
sanitizeLimit(searchParams.get("limit"))

function isIntegerString(v) {
  return typeof v === "string" && /^\d+$/.test(v)
}

try {
  const requests = await fetchAgentRequests(agentId, { limit })
} catch (err) {
  if (err.status === 400 && err.message === "Invalid limit query") {
    return fetchAgentRequests(agentId, { limit: undefined }) // fall back to default
  }
  throw err
}

When it happens

Trigger: GET agent requests with ?limit=ten, ?limit=1.5, ?limit=-1, ?limit=1e2, or limit containing spaces/plus signs. Note values outside 1-100 that are numeric pass this check but hit the range error instead.

Common situations: Pagination controls sending 'null'/'undefined' as strings; users typing non-numeric input into a free-text page-size field; template interpolation producing 'undefined' strings; locales formatting numbers with commas.

Related errors

• Limit query must be between 1 and 100
• Invalid page query
• Invalid bookmark query
• Invalid limit query
• Limit query must be between 1 and 100

AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29). Data as JSON: /api/errors/729cfc06a10f0925. Report an issue: GitHub.