Query parameter validation accepts limit=0 and negative values — returns all results

[gandalf-at-lerian]

Description

The limit query parameter validation in ValidateParameters / validatePagination only checks limit > maxPaginationLimit but does not reject limit <= 0. When limit=0 is passed:

• strconv.Atoi("0") returns 0
• 0 > 100 is false → validation passes
• MongoDB's SetLimit(0) means "no limit" → returns all documents
• API responds 200 with all results instead of 400

Similarly, negative values like limit=-1 and page=0 or page=-1 pass validation.

Affected Endpoints

This is in the shared pkg/net/http/httputils.go validatePagination function, so it affects all list endpoints across Ledger and CRM.

Location

pkg/net/http/httputils.go, function validatePagination (line ~330)

Expected Behavior

• limit <= 0 → HTTP 400 with structured error
• page <= 0 → HTTP 400 with structured error

Suggested Fix

Add a lower bound check in validatePagination:

if limit <= 0 {
    return "", pkg.ValidateBusinessError(constant.ErrInvalidQueryParameter, "", "limit")
}

And add page validation (currently not validated at all):

// in ValidateParameters, after the for loop:
if page <= 0 {
    return nil, pkg.ValidateBusinessError(constant.ErrInvalidQueryParameter, "", "page")
}

[gandalf-at-lerian]

Update: The same pagination validation gaps also affect the Alias API. Since the root cause is in the shared ValidateParameters / validatePagination in pkg/net/http/httputils.go, all list endpoints across both Ledger and CRM are affected, including:

• GET /v1/holders — limit=0, page=0, negative limit, non-numeric limit, non-numeric page
• GET /v1/holders/{id}/aliases — same issues
• All other list endpoints using ValidateParameters

[gandalf-at-lerian]

Update: The Organization API (GET /v1/organizations) is also affected by the same pagination validation gaps (limit=0, page=0, negative limit, non-numeric limit, non-numeric page).

Confirmed affected APIs so far:

• Holder API (GET /v1/holders)
• Alias API (GET /v1/holders/{id}/aliases)
• Organization API (GET /v1/organizations)
• Likely all other list endpoints sharing ValidateParameters