{"record":{"id":"c207485bd8e0e601","repo":"crowdsecurity/crowdsec","slug":"invalid-limit-value-w-w","errorCode":null,"errorMessage":"invalid limit value: %w: %w","messagePattern":"invalid limit value: %w: %w","errorType":"validation","errorClass":"InvalidFilter","httpStatus":null,"severity":"warning","filePath":"pkg/database/decisionfilter.go","lineNumber":85,"sourceCode":"\t\tcase \"scenarios_containing\":\n\t\t\tpredicates := decisionPredicatesFromStr(value[0], decision.ScenarioContainsFold)\n\t\t\tquery = query.Where(decision.Or(predicates...))\n\t\tcase \"scenarios_not_containing\":\n\t\t\tpredicates := decisionPredicatesFromStr(value[0], decision.ScenarioContainsFold)\n\t\t\tquery = query.Where(decision.Not(\n\t\t\t\tdecision.Or(\n\t\t\t\t\tpredicates...,\n\t\t\t\t),\n\t\t\t))\n\t\tcase \"ip\", \"range\":\n\t\t\trng, err = csnet.NewRange(value[0])\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"unable to convert '%s' to int: %w: %w\", value[0], err, InvalidIPOrRange)\n\t\t\t}\n\t\tcase \"limit\":\n\t\t\tlimit, err := strconv.Atoi(value[0])\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"invalid limit value: %w: %w\", err, InvalidFilter)\n\t\t\t}\n\n\t\t\tquery = query.Limit(limit)\n\t\tcase \"offset\":\n\t\t\toffset, err := strconv.Atoi(value[0])\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"invalid offset value: %w: %w\", err, InvalidFilter)\n\t\t\t}\n\n\t\t\tquery = query.Offset(offset)\n\t\tcase \"id_gt\":\n\t\t\tid, err := strconv.Atoi(value[0])\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"invalid id_gt value: %w: %w\", err, InvalidFilter)\n\t\t\t}\n\n\t\t\tquery = query.Where(decision.IDGT(id))\n\t\t}","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/database/decisionfilter.go#L67-L103","documentation":"applyDecisionFilter rejects the request because the 'limit' query parameter is not a valid integer (strconv.Atoi fails). The error is wrapped with the InvalidFilter sentinel so LAPI callers can classify it as a bad filter value.","triggerScenarios":"GET /v1/decisions?limit=abc or ?limit= (empty) or a float like ?limit=10.5 on any decisions endpoint that goes through QueryDecisionWithFilter.","commonSituations":"Shell scripts building query strings from untyped variables; copying 'limit=all' from another API; locale-formatted numbers with separators (1,000).","solutions":["Send a plain integer for limit (e.g. ?limit=100).","Omit the limit parameter when you don't need pagination.","Validate with strconv.Atoi (or equivalent) on the client before building the URL.","Check the wrapped strconv error to confirm the offending value."],"exampleFix":"// before\nGET /v1/decisions?limit=all\n// after\nGET /v1/decisions?limit=100","handlingStrategy":"validation","validationCode":"func validInt(v string) bool {\n    _, err := strconv.Atoi(v)\n    return err == nil\n}\nif limitParam != \"\" && !validInt(limitParam) {\n    limitParam = \"100\" // or drop the parameter\n}","typeGuard":null,"tryCatchPattern":"resp, err := lapi.GetDecisions(ctx, models.GetDecisionsOpts{Limit: &limit})\nif err != nil && strings.Contains(err.Error(), \"invalid limit value\") {\n    return fmt.Errorf(\"limit must be an integer, got %q\", limitRaw)\n}","preventionTips":["Type pagination params as ints end-to-end","Avoid locale-formatted numbers in URLs","Build query strings with url.Values, not string concat","Default to a sane limit rather than free-form input"],"tags":["api","query-parameter","pagination","validation"],"backgroundTag":"invalid-query-parameter","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}