Skip to content

Fix NoMethodError with tampered params#872

Merged
ddnexus merged 1 commit intoddnexus:masterfrom
excid3:patch-2
Feb 5, 2026
Merged

Fix NoMethodError with tampered params#872
ddnexus merged 1 commit intoddnexus:masterfrom
excid3:patch-2

Conversation

@excid3
Copy link
Contributor

@excid3 excid3 commented Feb 4, 2026

I've had some requests come in that are clearly messing with params such as ?page[]=2 and ?page[testing]=1

This causes an error when casting to_i here since page is an Array or Hash and not a String.

return [page.to_i, 1].max if force_integer

It raises a NoMethodError which isn't ideal to rescue from in a controller.

By casting to a String, this will fix the issue and return 0 when an invalid value is found since:

["2"].to_s.to_i #=> 0
{"testing" => "1"}.to_s.to_i #=> 0

This should make Pagy raise a lot less errors when the page param is tampered with by bots or malicious users.

The page param could be an Array or Hash which will raise a NoMethodError for `to_i`. By casting to a String, this will fix the issue and return 0 when an invalid value is found.
@ddnexus ddnexus merged commit 988f406 into ddnexus:master Feb 5, 2026
11 checks passed
@ddnexus
Copy link
Owner

ddnexus commented Feb 5, 2026

Simple and effective! Thank you Chris.

@excid3 excid3 deleted the patch-2 branch February 5, 2026 01:24
@RyanTG
Copy link
Contributor

RyanTG commented Feb 5, 2026

Neat, thanks.

For some reason our bot visitors' favorite thing to do is include a second limit param that only contains a single quote. ?limit=50&limit=%27&page=15. Not exactly malicious. Just... strange and annoying.

@excid3
Copy link
Contributor Author

excid3 commented Feb 5, 2026

That is annoying. limit could probably use the same treatment. Didn't even cross my mind yesterday.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants