Enforce a maximum page-size cap in the pagination utility to prevent large-limit abuse

[mikewheeleer]

Enforce a maximum page-size cap in the pagination utility to prevent large-limit abuse

Description

src/utils/pagination.ts parses page/limit query parameters for list endpoints. Without a hard upper bound on limit, a client can request an enormous page size and force the backend to read and serialize a huge result set in a single request, a denial-of-service amplification vector.

This issue clamps the effective limit to a configurable maximum and documents the cap in the response metadata.

Requirements and context

• Repository scope: Talenttrust/Talenttrust-Backend only.
• Clamp parsed limit to a configurable MAX_PAGE_SIZE (with a sane default).
• Coerce non-numeric / negative / zero limits to the default safely.
• Reflect the applied (possibly clamped) limit in the pagination metadata so clients can detect the cap.
• Keep the existing pagination response shape and helpers in src/utils/sorting.ts/src/utils/filtering.ts compatible.

Suggested execution

• Fork the repo and create a branch
• git checkout -b security/pagination-max-page-size
• Implement changes
  • Write code in: src/utils/pagination.ts.
  • Write comprehensive tests in: src/utils/pagination.test.ts — assert clamping at, above, and below the cap, plus invalid inputs.
  • Add documentation: document the cap and default in JSDoc and README.md.
  • Validate security: confirm no path bypasses the clamp.
• Test and commit

Test and commit

• Run npm test and npm run lint.
• Cover edge cases: limit just above cap, negative limit, NaN limit, and missing limit.

Example commit message

security: clamp pagination limit to a configurable maximum

Guidelines

• Minimum 95 percent test coverage for impacted modules.
• Clear, reviewer-focused documentation.
• Timeframe: 96 hours.

Community & contribution rewards

• 💬 Join the TalentTrust community on Discord for questions, reviews, and faster merges: https://discord.gg/WqnGpcPx
• ⭐ This is a GrantFox OSS / Official Campaign task and may be rewarded. When your PR is merged you'll be prompted to rate the project — if this issue and the maintainers helped you ship, we'd be grateful for a 5-star rating. Clear questions in Discord and tidy, well-tested PRs are the fastest path to a merge and a reward.

[mukadasamos]

@mukadasamos has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hi Maintainer, Please assign me to this issue. Thanks for your consideration

ℹ️ Repo Maintainers: To accept this application, review their application or assign @mukadasamos to this issue.

[dotmantissa]

@dotmantissa has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Please, assign this issue to me.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @dotmantissa to this issue.

[drips-wave]

Congratulations, @mukadasamos! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on June 30, 2026.

🧑‍💻 @mukadasamos: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊