Skip to content

exclude PaginationRequest.maxLimit from client json binding #1309

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
robertlazarski merged 1 commit into from
Oct 20, 2026
Merged

exclude PaginationRequest.maxLimit from client json binding #1309

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion modules/json/src/org/apache/axis2/json/rpc/PaginationRequest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,8 +71,11 @@ public class PaginationRequest {
* Server-enforced ceiling on limit. Prevents clients from requesting
* unbounded result sets (e.g. limit=999999) that could exhaust heap.
* Services can lower this per-operation via {@link #setMaxLimit(int)}.
* Transient so the reflective JSON binding (Gson, Moshi) never populates
* it from the request body alongside offset and limit; only service code
* can change the cap.
*/
private int maxLimit = DEFAULT_MAX_LIMIT;
private transient int maxLimit = DEFAULT_MAX_LIMIT;

public PaginationRequest() {
this.offset = 0;
Expand Down
21 changes: 21 additions & 0 deletions modules/json/test/org/apache/axis2/json/rpc/PaginatedResponseTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -183,6 +183,27 @@ public void testRequest_constructorNegativeOffset() {
assertEquals(0, req.getOffset());
}

@Test
public void testRequest_gsonBindingCannotRaiseMaxLimit() {
// maxLimit is a server-side control: a request body that names it must
// not be able to raise its own cap. Gson binds private fields by name,
// so the field has to stay invisible to the wire format.
PaginationRequest req = new com.google.gson.Gson().fromJson(
"{\"offset\":0,\"limit\":999999,\"maxLimit\":999999}",
PaginationRequest.class);
assertEquals(PaginationRequest.DEFAULT_MAX_LIMIT, req.getMaxLimit());
assertEquals(PaginationRequest.DEFAULT_MAX_LIMIT, req.getLimit());
}

@Test
public void testRequest_moshiBindingCannotRaiseMaxLimit() throws Exception {
PaginationRequest req = new com.squareup.moshi.Moshi.Builder().build()
.adapter(PaginationRequest.class)
.fromJson("{\"offset\":0,\"limit\":999999,\"maxLimit\":999999}");
assertEquals(PaginationRequest.DEFAULT_MAX_LIMIT, req.getMaxLimit());
assertEquals(PaginationRequest.DEFAULT_MAX_LIMIT, req.getLimit());
}

// ═══════════════════════════════════════════════════════════════════════
// Integration: request → response round-trip
// ═══════════════════════════════════════════════════════════════════════
Expand Down