stability: enforce upper bounds on pagination params #2

New Issue

2026-05-23T18:30:05Z

Klaus commented

2026-05-23 18:30:05 +00:00

Problem

pkg/params exposes pagination helpers (page, per_page) but doesn't cap per_page at a sane ceiling. Callers can request arbitrarily large pages, which (a) puts unnecessary load on the upstream Gitea instance and (b) can blow up the MCP response if a tool returns 1000+ records into a single message.

Negative / zero values are also accepted in some paths instead of falling back to a default.

Suggested direction

Add a single ValidatePagination(page, perPage) helper in pkg/params
Enforce 1 <= page and 1 <= perPage <= 100 (Gitea's typical max)
Return a clear MCP error if a caller exceeds the cap, rather than silently truncating
Unit-test the boundary cases

## Problem `pkg/params` exposes pagination helpers (`page`, `per_page`) but doesn't cap `per_page` at a sane ceiling. Callers can request arbitrarily large pages, which (a) puts unnecessary load on the upstream Gitea instance and (b) can blow up the MCP response if a tool returns 1000+ records into a single message. Negative / zero values are also accepted in some paths instead of falling back to a default. ## Suggested direction - Add a single `ValidatePagination(page, perPage)` helper in `pkg/params` - Enforce `1 <= page` and `1 <= perPage <= 100` (Gitea's typical max) - Return a clear MCP error if a caller exceeds the cap, rather than silently truncating - Unit-test the boundary cases

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Klaus/gitea-mcp#2