From 0ff009c695210c340d477945fbfa1837de306c89 Mon Sep 17 00:00:00 2001 From: silentgeckoaudit3801 Date: Thu, 23 Jul 2026 11:58:20 -0600 Subject: [PATCH 1/2] fix: cap transaction page size --- backend/src/controllers/transactionController.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/src/controllers/transactionController.ts b/backend/src/controllers/transactionController.ts index a5980689..1a1dea5f 100644 --- a/backend/src/controllers/transactionController.ts +++ b/backend/src/controllers/transactionController.ts @@ -4,7 +4,7 @@ import { AppError } from '../errors/AppError.js'; import { asyncHandler } from '../utils/asyncHandler.js'; const DEFAULT_LIMIT = 20; -const MAX_LIMIT = 500; +const MAX_LIMIT = 50; function parseLimit(value: unknown): number { if (typeof value !== 'string') return DEFAULT_LIMIT; From 31b0084f6e0f2b153e8354201cf07e391a8810a6 Mon Sep 17 00:00:00 2001 From: silentgeckoaudit3801 Date: Thu, 23 Jul 2026 11:58:21 -0600 Subject: [PATCH 2/2] test: cover transaction page size cap --- .../__tests__/transactionControllerLimits.test.ts | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 backend/src/controllers/__tests__/transactionControllerLimits.test.ts diff --git a/backend/src/controllers/__tests__/transactionControllerLimits.test.ts b/backend/src/controllers/__tests__/transactionControllerLimits.test.ts new file mode 100644 index 00000000..ec6b1491 --- /dev/null +++ b/backend/src/controllers/__tests__/transactionControllerLimits.test.ts @@ -0,0 +1,12 @@ +import { describe, expect, it } from '@jest/globals'; +import { readFileSync } from 'node:fs'; + +const source = readFileSync(new URL('../transactionController.ts', import.meta.url), 'utf8'); + +describe('transactionController pagination limits', () => { + it('caps transaction pages at the intended small maximum', () => { + expect(source).toContain('const MAX_LIMIT = 50;'); + expect(source).not.toContain('const MAX_LIMIT = 500;'); + expect(source).toContain('return Math.min(parsed, MAX_LIMIT);'); + }); +}); \ No newline at end of file