Fix: uint to int security

server/handlers/api-movie.go

@@ -29,17 +29,17 @@ import (
 )
 
 func GetPageItems[T any](ctx *gin.Context, items []T) ([]T, error) {
-	max, err := strconv.ParseUint(ctx.DefaultQuery("max", "10"), 10, 64)
+	max, err := strconv.ParseInt(ctx.DefaultQuery("max", "10"), 10, 64)
 	if err != nil {
 		return items, errors.New("max must be a number")
 	}
 
-	page, err := strconv.ParseUint(ctx.DefaultQuery("page", "1"), 10, 64)
+	page, err := strconv.ParseInt(ctx.DefaultQuery("page", "1"), 10, 64)
 	if err != nil {
 		return items, errors.New("page must be a number")
 	}
 
-	return utils.GetPageItems(items, int(max), int(page)), nil
+	return utils.GetPageItems(items, max, page), nil
 }
 
 func MovieList(ctx *gin.Context) {

utils/utils.go

@@ -27,16 +27,18 @@ func RandBytes(n int) []byte {
 	return b
 }
 
-func GetPageItems[T any](items []T, max, page int) []T {
+func GetPageItems[T any](items []T, max, page int64) []T {
+	if max <= 0 || page <= 0 {
+		return nil
+	}
 	start := (page - 1) * max
-	if start < 0 {
-		start = 0
-	} else if start > len(items) {
-		start = len(items)
+	l := int64(len(items))
+	if start > l {
+		start = l
 	}
-	end := int(page * max)
-	if end > len(items) {
-		end = len(items)
+	end := page * max
+	if end > l {
+		end = l
 	}
 	return items[start:end]
 }

utils/utils_test.go

@@ -0,0 +1,56 @@
+package utils_test
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/synctv-org/synctv/utils"
+)
+
+func TestGetPageItems(t *testing.T) {
+	type args struct {
+		items []int
+		max   int64
+		page  int64
+	}
+	tests := []struct {
+		name string
+		args args
+		want []int
+	}{
+		{
+			name: "Test Case 1",
+			args: args{
+				items: []int{1, 2, 3, 4, 5, 6, 7, 8, 9, 10},
+				max:   5,
+				page:  1,
+			},
+			want: []int{1, 2, 3, 4, 5},
+		},
+		{
+			name: "Test Case 2",
+			args: args{
+				items: []int{1, 2, 3, 4, 5, 6, 7, 8, 9, 10},
+				max:   5,
+				page:  2,
+			},
+			want: []int{6, 7, 8, 9, 10},
+		},
+		{
+			name: "Test Case 3",
+			args: args{
+				items: []int{1, 2, 3, 4, 5, 6, 7, 8, 9, 10},
+				max:   5,
+				page:  3,
+			},
+			want: []int{},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := utils.GetPageItems(tt.args.items, tt.args.max, tt.args.page); !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("GetPageItems() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}