{"record":{"id":"729cfc06a10f0925","repo":"Budibase/budibase","slug":"invalid-limit-query-729cfc","errorCode":null,"errorMessage":"Invalid limit query","messagePattern":"Invalid limit query","errorType":"http","errorClass":"HTTPError","httpStatus":400,"severity":"error","filePath":"packages/server/src/api/controllers/ai/agentRequests.ts","lineNumber":19,"sourceCode":"import { HTTPError } from \"@budibase/backend-core\"\nimport {\n  AGENT_REQUEST_STATUSES,\n  type AgentRequestStatus,\n  type FetchAgentRequestsResponse,\n  type UserCtx,\n} from \"@budibase/types\"\nimport sdk from \"../../../sdk\"\n\nconst DEFAULT_LIMIT = 100\n\nconst sanitizeLimitQuery = (limit?: string): number => {\n  const normalizedLimit = limit?.trim()\n  if (!normalizedLimit) {\n    return DEFAULT_LIMIT\n  }\n\n  if (!/^\\d+$/.test(normalizedLimit)) {\n    throw new HTTPError(\"Invalid limit query\", 400)\n  }\n\n  const parsedLimit = Number.parseInt(normalizedLimit, 10)\n  if (parsedLimit < 1 || parsedLimit > 100) {\n    throw new HTTPError(\"Limit query must be between 1 and 100\", 400)\n  }\n\n  return parsedLimit\n}\n\nconst sanitizePageQuery = (page?: string): number => {\n  const normalizedPage = page?.trim()\n  if (!normalizedPage) {\n    return 1\n  }\n\n  if (!/^\\d+$/.test(normalizedPage)) {\n    throw new HTTPError(\"Invalid page query\", 400)","sourceCodeStart":1,"sourceCodeEnd":37,"githubUrl":"https://github.com/Budibase/budibase/blob/a81a902e9a8fe55b467d106765f6638f12e35c49/packages/server/src/api/controllers/ai/agentRequests.ts#L1-L37","documentation":"Thrown by sanitizeLimitQuery when the `limit` query parameter is not a pure digit string. Empty/whitespace-only values fall back to DEFAULT_LIMIT, but any non-numeric value (e.g. 'abc', '10x', '1.5', '-5') fails the /^\\d+$/ test and produces this 400 error.","triggerScenarios":"GET agent requests with ?limit=ten, ?limit=1.5, ?limit=-1, ?limit=1e2, or limit containing spaces/plus signs. Note values outside 1-100 that are numeric pass this check but hit the range error instead.","commonSituations":"Pagination controls sending 'null'/'undefined' as strings; users typing non-numeric input into a free-text page-size field; template interpolation producing 'undefined' strings; locales formatting numbers with commas.","solutions":["Send only plain integer digits, e.g. ?limit=25","Omit the limit parameter to use the default","Sanitize client-side: parse and validate the value before building the URL","Convert booleans/null to undefined rather than stringifying"],"exampleFix":"// before\nconst url = `/requests?limit=${String(pageSize)}` // pageSize = undefined -> \"undefined\"\n// after\nconst url = pageSize ? `/requests?limit=${parseInt(pageSize, 10)}` : `/requests`","handlingStrategy":"validation","validationCode":"function sanitizeLimit(limit, { min = 1, max = 100 } = {}) {\n  if (limit === undefined || limit === null || String(limit).trim() === \"\") return undefined\n  const s = String(limit).trim()\n  if (!/^\\d+$/.test(s)) throw new Error(\"limit must be an integer\")\n  const n = parseInt(s, 10)\n  if (n < min || n > max) throw new Error(`limit must be between ${min} and ${max}`)\n  return n\n}\nsanitizeLimit(searchParams.get(\"limit\"))","typeGuard":"function isIntegerString(v) {\n  return typeof v === \"string\" && /^\\d+$/.test(v)\n}","tryCatchPattern":"try {\n  const requests = await fetchAgentRequests(agentId, { limit })\n} catch (err) {\n  if (err.status === 400 && err.message === \"Invalid limit query\") {\n    return fetchAgentRequests(agentId, { limit: undefined }) // fall back to default\n  }\n  throw err\n}","preventionTips":["Clamp numeric inputs with Math.min(100, Math.max(1, n)) before sending","Never stringify null/undefined into query strings; omit the key instead","Use a numeric page-size selector, not free text","Centralize query-building in one helper that sanitizes all params"],"tags":["validation","http-400","pagination","query-params"],"backgroundTag":"invalid-query-parameter","analyzedSha":"a81a902e9a8fe55b467d106765f6638f12e35c49","analyzedAt":"2026-08-29T01:03:10.972Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}