{"record":{"id":"2fed1ad0b8700238","repo":"t8y2/dbx","slug":"mongodb-aggregate-limit-must-be-between-0-and-in","errorCode":null,"errorMessage":"MongoDB aggregate limit must be between 0 and ${Integer.MAX_VALUE}","messagePattern":"MongoDB aggregate limit must be between 0 and (.+?)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"agents/drivers/mongodb/src/main/java/com/dbx/agent/mongodb/MongoAgent.java","lineNumber":649,"sourceCode":"            \"maxTimeMS\",\n            \"maxAwaitTimeMS\",\n            \"bypassDocumentValidation\",\n            \"collation\",\n            \"comment\",\n            \"hint\",\n            \"useCursor\"\n        );\n        for (String key : options.keySet()) {\n            if (!supported.contains(key)) {\n                throw new IllegalArgumentException(\"Unsupported MongoDB Legacy aggregate option: \" + key);\n            }\n        }\n    }\n\n    private static int aggregateMaxRows(JsonObject params) {\n        long value = params.has(\"limit\") ? params.get(\"limit\").getAsLong() : 100;\n        if (value < 0 || value > Integer.MAX_VALUE) {\n            throw new IllegalArgumentException(\"MongoDB aggregate limit must be between 0 and \" + Integer.MAX_VALUE);\n        }\n        return (int) value;\n    }\n\n    private static boolean aggregateBoolean(Document options, String key) {\n        Object value = options.get(key);\n        if (!(value instanceof Boolean)) {\n            throw new IllegalArgumentException(\"MongoDB aggregate option \" + key + \" must be a boolean\");\n        }\n        return (Boolean) value;\n    }\n\n    private static int aggregateNonNegativeInt(Document options, String key) {\n        long value = aggregateNonNegativeLong(options, key);\n        if (value > Integer.MAX_VALUE) {\n            throw new IllegalArgumentException(\"MongoDB aggregate option \" + key + \" is too large\");\n        }\n        return (int) value;","sourceCodeStart":631,"sourceCodeEnd":667,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/mongodb/src/main/java/com/dbx/agent/mongodb/MongoAgent.java#L631-L667","documentation":"aggregateMaxRows reads the top-level 'limit' parameter as a long and requires 0 <= limit <= Integer.MAX_VALUE because it is narrowed to an int for the result cap. Out-of-range values (negative, or above ~2.147e9) throw IllegalArgumentException before the aggregation runs.","triggerScenarios":"Calling aggregate with {\"limit\": -1} or an absurd value like {\"limit\": 99999999999} (or any value exceeding 2147483647).","commonSituations":"Config where limit=-1 meant 'unlimited' in another system; unvalidated user input or a JSON number that overflows int; copy-paste from APIs where 0/negative signals no cap.","solutions":["Set limit to a non-negative int-range value, e.g. 0–2147483647; 0 or omission defaults to the built-in 100.","Clamp on the caller side: Math.max(0, Math.min(value, Integer.MAX_VALUE)).","If you need effectively unbounded output, paginate with cursor batches instead of a huge limit.","Validate/sanitize the limit field before constructing the request."],"exampleFix":"// before\nlong limit = -1; // meant 'unlimited'\n// after\nint limit = (int) Math.max(0, Math.min(rawLimit, Integer.MAX_VALUE));","handlingStrategy":"validation","validationCode":"long limit = params.has(\"limit\") ? params.get(\"limit\").getAsLong() : 100;\nif (limit < 0 || limit > Integer.MAX_VALUE) {\n    throw new IllegalArgumentException(\"limit must be in [0, 2147483647]\");\n}","typeGuard":"static boolean isValidLimit(long value) {\n    return value >= 0 && value <= Integer.MAX_VALUE;\n}","tryCatchPattern":"try {\n    agent.aggregate(db, collection, pipeline, options);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().startsWith(\"MongoDB aggregate limit must be between\")) {\n        // clamp and retry, or reject the request with a typed validation error\n        params.addProperty(\"limit\", Math.max(0, params.get(\"limit\").getAsLong()));\n    } else throw e;\n}","preventionTips":["Treat 0/omission as the default (100), never -1 as 'unlimited'","Clamp user-supplied limits to a sane business max","Validate numeric params come in as JSON numbers, not strings","Avoid values near Integer.MAX_VALUE — they defeat the purpose of a limit"],"tags":["mongodb","aggregate","range-validation","limit"],"backgroundTag":"parameter-out-of-range","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}