在多处缺少分页校验，可能造成超大分页查询，进而导致DoS漏洞

Author: kingkingkingsonCreated Jan 21, 2026Updated Jan 21, 2026

描述

例如在NewsController的index方法中，入参含有用于分页查询的参数limit,然而没有校验这个limit的最大大小，可能造成超大分页查询，进而导致DoS漏洞（CWE-400）。

相关代码片段

java

    @RequestMapping(value = "", method = RequestMethod.GET)
    public String index(@RequestParam(required = false, defaultValue = "1", value = "page") int page,
                        @RequestParam(required = false, defaultValue = "orders", value = "sort") String sort,
                        @RequestParam(required = false, defaultValue = "desc", value = "order") String order,
                        HttpServletRequest request,
                        Model model) {
...
List<CmsArticle> articles = cmsArticleService.selectByExampleForOffsetPage(cmsArticleExample, (page - 1) * rows, rows);
}

建议修复

添加注解

java

@Min(value = 1)  @Max(value = 100) int limit,

Source: shuzheng/zheng

View original on GitHub View discussion on GitHub