fix(environment): ignore unsafe paging bounds (#9145)

src/domain/analysisView/environmentStatePaging.test.ts

@@ -1,5 +1,5 @@
 import { expect, it } from "vitest";
-import { startsAtBeginning } from "./environmentStatePaging.js";
+import { pageBound, startsAtBeginning } from "./environmentStatePaging.js";
 
 it("requires every recorded position to establish the beginning, including repeated names", () => {
   expect(startsAtBeginning(undefined)).toBe(true);
@@ -16,3 +16,12 @@ it("requires every recorded position to establish the beginning, including repea
   ])
     expect(startsAtBeginning(query), query).toBe(false);
 });
+
+it("does not infer a page bound from unsafe numeric query values", () => {
+  for (const query of [
+    "?_start=999999999999999999999999&_end=100",
+    "?limit=9007199254740992",
+    "?_start=9007199254740993&_end=9007199254740995",
+  ])
+    expect(pageBound(query, 5), query).toBeUndefined();
+});

src/domain/analysisView/environmentStatePaging.ts

@@ -64,15 +64,21 @@ const pageLimit = (
 ): number | undefined => {
   let size = Infinity;
   const range = { start: 0, end: Infinity };
+  let unsafeNumber = false;
   for (const [name, value] of iterateUrlQueryParameters(query ?? "")) {
     const key = name.toLowerCase();
     if (!/^\d+$/u.test(value)) continue;
     const number = Number(value);
+    if (!Number.isSafeInteger(number)) {
+      unsafeNumber = true;
+      continue;
+    }
     if (PAGE_SIZE_PARAMETERS.has(key)) {
       if (number > 0 || !unboundedZero) size = Math.min(size, number);
     } else if (key === "_start") range.start = number;
     else if (key === "_end") range.end = number;
   }
+  if (unsafeNumber) return undefined;
   const width = Math.min(size, Math.max(range.end - range.start, 0));
   return Number.isFinite(width) ? width : undefined;
 };