diff --git a/dashboard_server.py b/dashboard_server.py index cb67155..8ebb8cc 100644 --- a/dashboard_server.py +++ b/dashboard_server.py @@ -1920,9 +1920,10 @@ def handle_api_campaign_history(self, query_params: Dict[str, List[str]]): if "limit" in query_params: try: limit = int(query_params["limit"][0]) - limit = min(limit, _MAX_API_LIMIT) except (ValueError, IndexError): - limit = 25 + self.send_error_response(400, "limit must be an integer") + return + limit = min(limit, _MAX_API_LIMIT) try: self.send_json_response(load_campaign_history(CAMPAIGN_HISTORY_ROOT, limit=limit)) except Exception: @@ -1934,9 +1935,10 @@ def handle_api_validation_history(self, query_params: Dict[str, List[str]]): if "limit" in query_params: try: limit = int(query_params["limit"][0]) - limit = min(limit, _MAX_API_LIMIT) except (ValueError, IndexError): - limit = 10 + self.send_error_response(400, "limit must be an integer") + return + limit = min(limit, _MAX_API_LIMIT) try: self.send_json_response(load_validation_history(VALIDATION_HISTORY_ROOT, limit=limit)) except Exception: @@ -1948,9 +1950,10 @@ def handle_api_preflight_history(self, query_params: Dict[str, List[str]]): if "limit" in query_params: try: limit = int(query_params["limit"][0]) - limit = min(limit, _MAX_API_LIMIT) except (ValueError, IndexError): - limit = 10 + self.send_error_response(400, "limit must be an integer") + return + limit = min(limit, _MAX_API_LIMIT) try: self.send_json_response(load_preflight_history(PREFLIGHT_HISTORY_ROOT, limit=limit)) except Exception: @@ -1969,9 +1972,10 @@ def handle_api_evidence_chain_history(self, query_params: Dict[str, List[str]]): if "limit" in query_params: try: limit = int(query_params["limit"][0]) - limit = min(limit, _MAX_API_LIMIT) except (ValueError, IndexError): - limit = 10 + self.send_error_response(400, "limit must be an integer") + return + limit = min(limit, _MAX_API_LIMIT) try: self.send_json_response(load_evidence_chain_history(EVIDENCE_CHAIN_HISTORY_ROOT, limit=limit)) except Exception: diff --git a/test_dashboard_api_limits.py b/test_dashboard_api_limits.py index 24239ae..2724c4d 100644 --- a/test_dashboard_api_limits.py +++ b/test_dashboard_api_limits.py @@ -99,6 +99,18 @@ def test_cleanup_non_integer_keep_latest_keeps_default(self): candidate_limit=25, ) + def test_history_non_integer_limit_is_400(self): + handler = _handler() + for method in ( + handler.handle_api_campaign_history, + handler.handle_api_validation_history, + handler.handle_api_preflight_history, + handler.handle_api_evidence_chain_history, + ): + handler.send_error_response.reset_mock() + method({"limit": ["nope"]}) + handler.send_error_response.assert_called_once_with(400, "limit must be an integer") + def test_options_preflight_does_not_require_a_bearer(self): old_token = dashboard_server.DASHBOARD_TOKEN old_origin = dashboard_server.DASHBOARD_CORS_ORIGIN