diff --git a/aurweb/rpc.py b/aurweb/rpc.py index bfa96f59..6e2a27fe 100644 --- a/aurweb/rpc.py +++ b/aurweb/rpc.py @@ -275,7 +275,11 @@ class RPC: # Union all subqueries together. max_results = config.getint("options", "max_rpc_results") - query = subqueries[0].union_all(*subqueries[1:]).limit(max_results) + query = subqueries[0].union_all(*subqueries[1:]).limit( + max_results + 1).all() + + if len(query) > max_results: + raise RPCError("Too many package results.") # Store our extra information in a class-wise dictionary, # which contains package id -> extra info dict mappings. @@ -307,7 +311,11 @@ class RPC: search.search_by(by, arg) max_results = config.getint("options", "max_rpc_results") - results = self._entities(search.results()).limit(max_results) + results = self._entities(search.results()).limit(max_results + 1).all() + + if len(results) > max_results: + raise RPCError("Too many package results.") + return self._assemble_json_data(results, self._get_json_data) def _handle_msearch_type(self, args: List[str] = [], **kwargs)\ diff --git a/test/test_rpc.py b/test/test_rpc.py index 7847899c..a67a026e 100644 --- a/test/test_rpc.py +++ b/test/test_rpc.py @@ -795,3 +795,34 @@ def test_rpc_post(client: TestClient, packages: List[Package]): resp = request.post("/rpc", data=data) assert resp.status_code == int(HTTPStatus.OK) assert resp.json().get("resultcount") == 2 + + +def test_rpc_too_many_search_results(client: TestClient, + packages: List[Package]): + config_getint = config.getint + + def mock_config(section: str, key: str): + if key == "max_rpc_results": + return 1 + return config_getint(section, key) + + params = {"v": 5, "type": "search", "arg": "chungus"} + with mock.patch("aurweb.config.getint", side_effect=mock_config): + with client as request: + resp = request.get("/rpc", params=params) + assert resp.json().get("error") == "Too many package results." + + +def test_rpc_too_many_info_results(client: TestClient, packages: List[Package]): + config_getint = config.getint + + def mock_config(section: str, key: str): + if key == "max_rpc_results": + return 1 + return config_getint(section, key) + + params = {"v": 5, "type": "info", "arg[]": [p.Name for p in packages]} + with mock.patch("aurweb.config.getint", side_effect=mock_config): + with client as request: + resp = request.get("/rpc", params=params) + assert resp.json().get("error") == "Too many package results."