{"record":{"id":"e9ab9a7ed2907f7a","repo":"crowdsecurity/crowdsec","slug":"bad-limit-in-parameters-s-w","errorCode":null,"errorMessage":"bad limit in parameters: %s: %w","messagePattern":"bad limit in parameters: (.+?): %w","errorType":"exception","errorClass":"QueryFail","httpStatus":null,"severity":"warning","filePath":"pkg/database/alerts.go","lineNumber":814,"sourceCode":"}\n\nfunc (c *Client) QueryAlertWithFilter(ctx context.Context, filter map[string][]string) ([]*ent.Alert, error) {\n\tsort := \"DESC\" // we sort by desc by default\n\n\tif val, ok := filter[\"sort\"]; ok {\n\t\tif val[0] != \"ASC\" && val[0] != \"DESC\" {\n\t\t\tc.Log.Errorf(\"invalid 'sort' parameter: %s\", val)\n\t\t} else {\n\t\t\tsort = val[0]\n\t\t}\n\t}\n\n\tlimit := defaultLimit\n\n\tif val, ok := filter[\"limit\"]; ok {\n\t\tlimitConv, err := strconv.Atoi(val[0])\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"bad limit in parameters: %s: %w\", val, QueryFail)\n\t\t}\n\n\t\tlimit = limitConv\n\t}\n\n\toffset := 0\n\tret := make([]*ent.Alert, 0)\n\n\tfor {\n\t\talerts := c.Ent.Alert.Query()\n\n\t\talerts, err := applyAlertFilter(alerts, filter)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\t// only if with_decisions is present and set to false, we exclude this\n\t\tif val, ok := filter[\"with_decisions\"]; ok && val[0] == \"false\" {","sourceCodeStart":796,"sourceCodeEnd":832,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/database/alerts.go#L796-L832","documentation":"QueryAlertWithFilter parses the `limit` key from the filter map as an integer; a non-numeric value triggers this error wrapped with QueryFail. The caller supplied a limit the parser cannot convert with strconv.Atoi.","triggerScenarios":"Calling QueryAlertWithFilter (directly or via FindAlerts/FlushAlerts/LAPI /alerts) with filter[\"limit\"][0] set to something like \"abc\", \"\", or \"10.5\".","commonSituations":"Hand-crafted LAPI URLs like ?limit=ten; scripts that URL-encode wrongly; empty limit param forwarded by a reverse proxy.","solutions":["Pass a plain integer as the limit parameter (e.g. limit=100)","Omit the limit parameter entirely to use the default","On the caller side, validate the value with strconv.Atoi before building the request","Check proxies/scripts that may inject empty query values"],"exampleFix":"// before\nreq := \"/alerts/?limit=\" + userInput\n// after\nn, err := strconv.Atoi(userInput)\nif err != nil {\n    return fmt.Errorf(\"invalid limit: %w\", err)\n}\nreq := fmt.Sprintf(\"/alerts/?limit=%d\", n)","handlingStrategy":"validation","validationCode":"if limitStr != \"\" {\n    if _, err := strconv.Atoi(limitStr); err != nil {\n        return fmt.Errorf(\"limit must be an integer, got %q\", limitStr)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate query params before building LAPI requests","Never forward raw user input into the limit parameter","Document that omitting limit uses the server default"],"tags":["pagination","validation","query-parameters"],"backgroundTag":"invalid-query-parameter","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}