hutiefang76 opened a new issue, #4401:
URL: https://github.com/apache/amoro/issues/4401
## What happened?
getOptimizers and getOptimizerTables accept non-positive page/pageSize and
compute the offset with unchecked int arithmetic. Invalid values reach list
pagination or database querying, with behavior depending on the data. Large
positive values can also overflow the offset.
## Affects Versions
master at 9442f8c0fe86f3199c77c21b730e1d9cf6cfe984.
## What table formats are you seeing the problem on?
AMS; optimizer list queries are not table-format specific.
## What engines are you seeing the problem on?
AMS.
## How to reproduce
Call either `GET
/api/ams/v1/optimize/optimizerGroups/{optimizerGroup}/optimizers` or the
sibling `/tables` endpoint with one of these query strings:
- `page=0&pageSize=20`
- `page=-1&pageSize=20`
- `page=1&pageSize=0`
- `page=1&pageSize=-1`
- `page=2147483647&pageSize=20`
The controller currently calls its downstream manager before validating
these ranges. The last example overflows the int offset. Controller regression
tests use the real Javalin Validator and the real controller, with manager
dependencies mocked; no full HTTP acceptance result is claimed.
## Expected behavior / proposed approach
Reject invalid query parameters through the existing Javalin validation
chain before reading optimizer or table data. Preserve default page 1 / size
20, valid offsets, sorting, group filters and total counts. Bound the offset
using long arithmetic without changing the manager interface.
## Relevant log output
All 10 invalid-input regression cases fail on the original controller
because it does not reject the ranges before manager access.
## Are you willing to submit a PR?
- [x] Yes I am willing to submit a PR!
## Code of Conduct
- [x] I agree to follow this project's Code of Conduct.
## AI assistance
Code was assisted by DeepSeek v4 Flash via Reasonix 1.39.4; submission text
was assisted by Codex. The patch and local test results were reviewed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
