Skip to content

Validate page param in Stats API breakdown endpoint#6501

Open
nafey7 wants to merge 1 commit into
plausible:masterfrom
nafey7:fix/breakdown-api-page-param-validation
Open

Validate page param in Stats API breakdown endpoint#6501
nafey7 wants to merge 1 commit into
plausible:masterfrom
nafey7:fix/breakdown-api-page-param-validation

Conversation

@nafey7

@nafey7 nafey7 commented Jul 12, 2026

Copy link
Copy Markdown

Changes

The public Stats API GET /api/v1/stats/breakdown endpoint passed the page query parameter straight into String.to_integer/1, which raises ArgumentError on any non-numeric input — resulting in a 500 Internal Server Error.

This PR validates page the same way the sibling limit parameter is already validated (validate_or_default_limit/1): invalid or non-positive values now return a clean 400 with a descriptive message.

defp validate_or_default_page(%{"page" => page}) do
  case Integer.parse(page) do
    {page, ""} when page > 0 -> {:ok, page}
    _ -> {:error, "Please provide page as a number greater than 0."}
  end
end

defp validate_or_default_page(_), do: {:ok, 1}

Tests

Added tests to breakdown_test.exs covering non-integer, negative, and zero page values (mirroring the existing limit validation tests).

Notes

  • Behavior for valid page values (including the default of 1 when omitted) is unchanged.
  • CHANGELOG updated under a new Fixed section.

Fixes #6500

The public Stats API `/api/v1/stats/breakdown` endpoint passed the
`page` query parameter directly into `String.to_integer/1`, which raises
`ArgumentError` on any non-numeric input, resulting in a 500 Internal
Server Error.

This mirrors the validation already applied to the sibling `limit`
parameter: invalid values now return a clean 400 response with a helpful
message instead of crashing.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@CLAassistant

CLAassistant commented Jul 12, 2026

Copy link
Copy Markdown

CLA assistant check
All committers have signed the CLA.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Stats API breakdown endpoint returns 500 on non-integer page parameter

3 participants