Bug
GET /api/notifications clamps limit, but only clamps offset to a minimum of 0. Very large offset values are passed directly into the Supabase .range() call.
Impact
A request such as ?offset=999999999&limit=25 can ask the database for an extreme range start. Other recently hardened pagination endpoints cap offsets/page values before building ranges, so notifications should do the same.
Expected
Malformed and negative offsets should default/clamp to 0, and extremely large offsets should be capped before .range() is called.
Bug
GET /api/notificationsclampslimit, but only clampsoffsetto a minimum of 0. Very large offset values are passed directly into the Supabase.range()call.Impact
A request such as
?offset=999999999&limit=25can ask the database for an extreme range start. Other recently hardened pagination endpoints cap offsets/page values before building ranges, so notifications should do the same.Expected
Malformed and negative offsets should default/clamp to 0, and extremely large offsets should be capped before
.range()is called.