From bb7402ec7bfd59d13feddd5d6b2822949c43f37d Mon Sep 17 00:00:00 2001
From: aiirvizionz <david.lopezhuerta01@gmail.com>
Date: Sat, 18 Jul 2026 17:18:34 -0600
Subject: [PATCH] fix(messages): reject non-decimal pagination values

---
 src/app/api/chat/messages/pagination.js      | 1 +
 src/app/api/chat/messages/pagination.test.js | 7 +++++++
 2 files changed, 8 insertions(+)

diff --git a/src/app/api/chat/messages/pagination.js b/src/app/api/chat/messages/pagination.js
index 588bba46..5e5ba919 100644
--- a/src/app/api/chat/messages/pagination.js
+++ b/src/app/api/chat/messages/pagination.js
@@ -18,6 +18,7 @@ export function normalizeMessagePagination(searchParams) {
 
 function readInteger(value, { fallback, min, max }) {
   if (value == null || value === '') return fallback;
+  if (!/^\d+$/.test(value)) return fallback;
 
   const parsed = Number(value);
   if (!Number.isInteger(parsed) || parsed < min) return fallback;
diff --git a/src/app/api/chat/messages/pagination.test.js b/src/app/api/chat/messages/pagination.test.js
index 45071ed8..15e9c252 100644
--- a/src/app/api/chat/messages/pagination.test.js
+++ b/src/app/api/chat/messages/pagination.test.js
@@ -23,6 +23,13 @@ describe('normalizeMessagePagination', () => {
     });
   });
 
+  it('rejects non-decimal integer pagination spellings', () => {
+    expect(normalizeMessagePagination(new URLSearchParams('limit=1e2&offset=0x10'))).toEqual({
+      limit: 50,
+      offset: 0
+    });
+  });
+
   it('caps oversized limits before building the database range', () => {
     expect(normalizeMessagePagination(new URLSearchParams('limit=1000&offset=2'))).toEqual({
       limit: 100,