fix: additional input validation for CVE graphQL query (#2408)

It is possible to ask for a very large limit size which can exhaust
memory.

Signed-off-by: Ramkumar Chinchani <rchincha@cisco.com>

errors/errors.go

@@ -117,6 +117,7 @@ var (
 	ErrEmptyDigest                    = errors.New("digest can't be empty string")
 	ErrInvalidRepoRefFormat           = errors.New("invalid image reference format, use [repo:tag] or [repo@digest]")
 	ErrLimitIsNegative                = errors.New("pagination limit has negative value")
+	ErrLimitIsExcessive               = errors.New("pagination limit has excessive value")
 	ErrOffsetIsNegative               = errors.New("pagination offset has negative value")
 	ErrSortCriteriaNotSupported       = errors.New("the pagination sort criteria is not supported")
 	ErrMediaTypeNotSupported          = errors.New("media type is not supported")

pkg/extensions/search/cve/pagination.go

@@ -62,6 +62,8 @@ type CvePageFinder struct {
 	pageBuffer []cvemodel.CVE
 }
 
+const maxCvePageLimit = 4 * 1024
+
 func NewCvePageFinder(limit, offset int, sortBy cvemodel.SortCriteria) (*CvePageFinder, error) {
 	if sortBy == "" {
 		sortBy = SeverityDsc
@@ -71,6 +73,10 @@ func NewCvePageFinder(limit, offset int, sortBy cvemodel.SortCriteria) (*CvePage
 		return nil, zerr.ErrLimitIsNegative
 	}
 
+	if limit > maxCvePageLimit {
+		return nil, zerr.ErrLimitIsExcessive
+	}
+
 	if offset < 0 {
 		return nil, zerr.ErrOffsetIsNegative
 	}

pkg/extensions/search/cve/pagination_test.go

@@ -415,6 +415,23 @@ func TestCVEPagination(t *testing.T) {
 					previousSeverity = severityToInt[cve.Severity]
 				}
 			})
+			Convey("bad limits", func() {
+				_, _, _, err := cveInfo.GetCVEListForImage(ctx, "repo1", "0.1.0", "", "", "", cvemodel.PageInput{
+					Limit:  -1,
+					Offset: 3,
+					SortBy: cveinfo.AlphabeticAsc,
+				},
+				)
+				So(err, ShouldNotBeNil)
+
+				_, _, _, err = cveInfo.GetCVEListForImage(ctx, "repo1", "0.1.0", "", "", "", cvemodel.PageInput{
+					Limit:  4097,
+					Offset: 3,
+					SortBy: cveinfo.AlphabeticAsc,
+				},
+				)
+				So(err, ShouldNotBeNil)
+			})
 		})
 	})
 }