From b571732d5b312e97d69a5d4efdf40471ced7b14d Mon Sep 17 00:00:00 2001 From: rissrice2105-agent Date: Sat, 4 Jul 2026 17:13:08 -0600 Subject: [PATCH] fix(mailbox): validate bot list limits --- internal/mailbox/bot.go | 6 +++++- internal/mailbox/mailbox_test.go | 20 ++++++++++++++++++++ 2 files changed, 25 insertions(+), 1 deletion(-) diff --git a/internal/mailbox/bot.go b/internal/mailbox/bot.go index 8ba7b09..8391c95 100644 --- a/internal/mailbox/bot.go +++ b/internal/mailbox/bot.go @@ -53,7 +53,11 @@ func RunBot(ctx context.Context, c *Client, args []string, in io.Reader, out io. } limit := 0 if len(args) > 2 { - limit, _ = strconv.Atoi(args[2]) + n, err := strconv.Atoi(args[2]) + if err != nil || n <= 0 { + return fail(fmt.Errorf("invalid list limit %q", args[2])) + } + limit = n } v, err := c.List(ctx, mailbox, limit) if err != nil { diff --git a/internal/mailbox/mailbox_test.go b/internal/mailbox/mailbox_test.go index 8dabbfa..45d595b 100644 --- a/internal/mailbox/mailbox_test.go +++ b/internal/mailbox/mailbox_test.go @@ -1,8 +1,10 @@ package mailbox import ( + "bytes" "context" "errors" + "strings" "testing" "time" @@ -210,3 +212,21 @@ func TestFlagAndDelete(t *testing.T) { t.Fatal("uid 1 should be deleted") } } + +func TestRunBotListRejectsInvalidLimit(t *testing.T) { + c := paidClient(seeded()) + + for _, args := range [][]string{ + {"list", Inbox, "nope"}, + {"list", Inbox, "-5"}, + } { + var out bytes.Buffer + err := RunBot(context.Background(), c, args, strings.NewReader(""), &out) + if err == nil { + t.Fatalf("RunBot(%v) expected error", args) + } + if !strings.Contains(out.String(), "invalid list limit") { + t.Fatalf("RunBot(%v) output = %q, want invalid limit error", args, out.String()) + } + } +}