Reject malformed pagination cursor lengths #92

Merged

yuris merged 1 commit from feat/issue-91-cursor-length into main

2026-09-23 09:34:32 +00:00

yuris commented

2026-09-23 09:29:17 +00:00

Owner

Closes #91

Summary

Require pagination cursors to have the exact decoded payload-and-HMAC size. Overlong cursors are rejected as malformed before signature verification; underlength cursors remain rejected. The API keeps the documented cursor_expired response.

Verification

nix develop --command cargo test --test issue45_pagination_tests — 10 passed, 0 failed, 0 ignored; exit 0.
The regression obtains a real API-issued cursor, adds trailing bytes and truncates it, then checks HTTP 422, cursor_expired, and exit code 2 through the shared mapper.
A narrow decoder assertion proves the overlong form is classified as malformed before HMAC verification.

Scope

Changed files: src/api/pagination.rs and tests/issue45_pagination_tests.rs. No project-wide suite, formatter, or linter is claimed here.

Closes #91 ## Summary Require pagination cursors to have the exact decoded payload-and-HMAC size. Overlong cursors are rejected as malformed before signature verification; underlength cursors remain rejected. The API keeps the documented cursor_expired response. ## Verification - nix develop --command cargo test --test issue45_pagination_tests — 10 passed, 0 failed, 0 ignored; exit 0. - The regression obtains a real API-issued cursor, adds trailing bytes and truncates it, then checks HTTP 422, cursor_expired, and exit code 2 through the shared mapper. - A narrow decoder assertion proves the overlong form is classified as malformed before HMAC verification. ## Scope Changed files: src/api/pagination.rs and tests/issue45_pagination_tests.rs. No project-wide suite, formatter, or linter is claimed here.

yuris added 1 commit

2026-09-23 09:29:17 +00:00

fix(api): reject malformed pagination cursor lengths 09c76bc4f7

yuris merged commit 273b4a05b7 into main

2026-09-23 09:34:32 +00:00

yuris referenced this pull request from a commit

2026-09-23 09:34:34 +00:00

Reject malformed pagination cursor lengths (#92)

yuris referenced this pull request from a commit

2026-09-23 11:54:43 +00:00

Reject malformed pagination cursor lengths (#92)