Feathers: [Security] Querying $limit=null

[matiaslopezd]

Steps to reproduce

Do HTTP request to any service with parameter $limit=null. This allow to users request data without limit. This happen with a value equal to null or any string.

Expected behavior

Add validation for not allow to externals request to access to unlimited data with $limit value different to a number.

Actual behavior

It allow to users access without limit, bypassing paginate.max value in default.json and causes an overload in server.

[daffl]

Well crap, today I learned that Math.min(10, NaN) is actually NaN. Fix in #1607 will return the default pagination instead.

[matiaslopezd]

@daffl Great!! I love when we can contribute and the community still active in the years!

I contributed in opencollective with very small budget but soon I'll be able to more :smile:

[bertho-zero]

Also:

Math.max(10, NaN) // NaN

[daffl]

And I thought I knew many of JavaScript's weird quirks but this one threw me off, too:

Math.min(10, NaN) === NaN // false
Math.max(10, NaN) === NaN // false

Thanks for contributing and thanks again for the catch @matiaslopezd - the fix has been released in all db adapters with a deprecation notice.