crowdsecurity/crowdsec · warning · QueryFail

bad limit in parameters: %s: %w

Error message

bad limit in parameters: %s: %w

What it means

QueryAlertWithFilter parses the `limit` key from the filter map as an integer; a non-numeric value triggers this error wrapped with QueryFail. The caller supplied a limit the parser cannot convert with strconv.Atoi.

Source

Thrown at pkg/database/alerts.go:814

}

func (c *Client) QueryAlertWithFilter(ctx context.Context, filter map[string][]string) ([]*ent.Alert, error) {
	sort := "DESC" // we sort by desc by default

	if val, ok := filter["sort"]; ok {
		if val[0] != "ASC" && val[0] != "DESC" {
			c.Log.Errorf("invalid 'sort' parameter: %s", val)
		} else {
			sort = val[0]
		}
	}

	limit := defaultLimit

	if val, ok := filter["limit"]; ok {
		limitConv, err := strconv.Atoi(val[0])
		if err != nil {
			return nil, fmt.Errorf("bad limit in parameters: %s: %w", val, QueryFail)
		}

		limit = limitConv
	}

	offset := 0
	ret := make([]*ent.Alert, 0)

	for {
		alerts := c.Ent.Alert.Query()

		alerts, err := applyAlertFilter(alerts, filter)
		if err != nil {
			return nil, err
		}

		// only if with_decisions is present and set to false, we exclude this
		if val, ok := filter["with_decisions"]; ok && val[0] == "false" {

View on GitHub (pinned to 909b515798)

Solutions

1. Pass a plain integer as the limit parameter (e.g. limit=100)
2. Omit the limit parameter entirely to use the default
3. On the caller side, validate the value with strconv.Atoi before building the request
4. Check proxies/scripts that may inject empty query values

Example fix

// before
req := "/alerts/?limit=" + userInput
// after
n, err := strconv.Atoi(userInput)
if err != nil {
    return fmt.Errorf("invalid limit: %w", err)
}
req := fmt.Sprintf("/alerts/?limit=%d", n)

if limitStr != "" {
    if _, err := strconv.Atoi(limitStr); err != nil {
        return fmt.Errorf("limit must be an integer, got %q", limitStr)
    }
}

When it happens

Trigger: Calling QueryAlertWithFilter (directly or via FindAlerts/FlushAlerts/LAPI /alerts) with filter["limit"][0] set to something like "abc", "", or "10.5".

Common situations: Hand-crafted LAPI URLs like ?limit=ten; scripts that URL-encode wrongly; empty limit param forwarded by a reverse proxy.

Understand the failure class

Background: "Invalid query parameter" / "Failed to parse value of ...": fixing bad query string parameters across APIs — this error's family across 36 libraries.

Related errors

• invalid limit value: %w: %w
• invalid offset value: %w: %w
• invalid id_gt value: %w: %w
• group_name is mandatory for CloudwatchSource
• path must start with /

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/e9ab9a7ed2907f7a. Report an issue: GitHub.