fix(security): cap authenticated message query limit to 200

commit: 77eb01c4bf68ec281e3e7b2ec768918326257129
author: Kit · 8mo ago · 2026-02-16 11:03 UTC
parent: d7a3f1f
signature: SSH UnverifiedSHA256:H91DFuEG4jpk5edzLA4aUKkpv4zv9Q339ipRmkph6Tk The key is unknown

1 file · +2 -1

M src/convex/queries.ts +2 -1


@@ -172,8 +172,9 @@ export const getMessages = authQuery({
172	172		limit: v.optional(v.number())
173	173		},
174	174		handler: async (ctx, args) => {
	175	+	const MAX_AUTH_MESSAGE_LIMIT = 200;
175	176		const rawLimit = args.limit ?? 100;
176		-	const limit = Math.max(1, Math.floor(rawLimit));
	177	+	const limit = Math.max(1, Math.min(MAX_AUTH_MESSAGE_LIMIT, Math.floor(rawLimit)));
177	178		const query = ctx.db
178	179		.query('messages')
179	180		.withIndex('by_chatRoom', (q) => q.eq('chatRoomId', args.roomId))

 		limit: v.optional(v.number())
 	},
 	handler: async (ctx, args) => {
+		const MAX_AUTH_MESSAGE_LIMIT = 200;
 		const rawLimit = args.limit ?? 100;
-		const limit = Math.max(1, Math.floor(rawLimit));
+		const limit = Math.max(1, Math.min(MAX_AUTH_MESSAGE_LIMIT, Math.floor(rawLimit)));
 		const query = ctx.db
 			.query('messages')
 			.withIndex('by_chatRoom', (q) => q.eq('chatRoomId', args.roomId))