From cfa7ebb0206aaf3cf5aeaf583f9b9336d2f9fea4 Mon Sep 17 00:00:00 2001
From: ShuaixinHuang <1836656514@qq.com>
Date: Fri, 6 Nov 2026 22:18:25 +0800
Subject: [PATCH] fix(environment): ignore unsafe paging bounds (#9145)

---
 .../analysisView/environmentStatePaging.test.ts       | 11 ++++++++++-
 src/domain/analysisView/environmentStatePaging.ts     |  6 ++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/src/domain/analysisView/environmentStatePaging.test.ts b/src/domain/analysisView/environmentStatePaging.test.ts
index e679086ba7..bb472e4ecc 100644
--- a/src/domain/analysisView/environmentStatePaging.test.ts
+++ b/src/domain/analysisView/environmentStatePaging.test.ts
@@ -1,5 +1,5 @@
 import { expect, it } from "vitest";
-import { startsAtBeginning } from "./environmentStatePaging.js";
+import { pageBound, startsAtBeginning } from "./environmentStatePaging.js";
 
 it("requires every recorded position to establish the beginning, including repeated names", () => {
   expect(startsAtBeginning(undefined)).toBe(true);
@@ -16,3 +16,12 @@ it("requires every recorded position to establish the beginning, including repea
   ])
     expect(startsAtBeginning(query), query).toBe(false);
 });
+
+it("does not infer a page bound from unsafe numeric query values", () => {
+  for (const query of [
+    "?_start=999999999999999999999999&_end=100",
+    "?limit=9007199254740992",
+    "?_start=9007199254740993&_end=9007199254740995",
+  ])
+    expect(pageBound(query, 5), query).toBeUndefined();
+});
diff --git a/src/domain/analysisView/environmentStatePaging.ts b/src/domain/analysisView/environmentStatePaging.ts
index ea2f984cff..91cdfdc96c 100644
--- a/src/domain/analysisView/environmentStatePaging.ts
+++ b/src/domain/analysisView/environmentStatePaging.ts
@@ -64,15 +64,21 @@ const pageLimit = (
 ): number | undefined => {
   let size = Infinity;
   const range = { start: 0, end: Infinity };
+  let unsafeNumber = false;
   for (const [name, value] of iterateUrlQueryParameters(query ?? "")) {
     const key = name.toLowerCase();
     if (!/^\d+$/u.test(value)) continue;
     const number = Number(value);
+    if (!Number.isSafeInteger(number)) {
+      unsafeNumber = true;
+      continue;
+    }
     if (PAGE_SIZE_PARAMETERS.has(key)) {
       if (number > 0 || !unboundedZero) size = Math.min(size, number);
     } else if (key === "_start") range.start = number;
     else if (key === "_end") range.end = number;
   }
+  if (unsafeNumber) return undefined;
   const width = Math.min(size, Math.max(range.end - range.start, 0));
   return Number.isFinite(width) ? width : undefined;
 };