From a33a365a699779c6e83094811d4b8f483fbdda35 Mon Sep 17 00:00:00 2001 From: Chris Coutinho Date: Fri, 8 May 2026 18:35:20 +0200 Subject: [PATCH] fix(viz_routes): validate chunk_index/total_chunks bounds in OAuth route PR #767 review noted that the OAuth viz route used bare int() parsing for chunk_index and total_chunks while the bearer-token visualization route validates them via _parse_int_param. Mirror the same bounds check so total_chunks=0 and negative chunk_index return 400 instead of silently suppressing adjacent-chunk context. Co-Authored-By: Claude Opus 4.7 (1M context) --- nextcloud_mcp_server/auth/viz_routes.py | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/nextcloud_mcp_server/auth/viz_routes.py b/nextcloud_mcp_server/auth/viz_routes.py index 21c1176a..331173b2 100644 --- a/nextcloud_mcp_server/auth/viz_routes.py +++ b/nextcloud_mcp_server/auth/viz_routes.py @@ -23,6 +23,7 @@ from starlette.authentication import requires from starlette.requests import Request from starlette.responses import HTMLResponse, JSONResponse +from nextcloud_mcp_server.api.management import _parse_int_param from nextcloud_mcp_server.auth.userinfo_routes import ( _get_authenticated_client_for_userinfo, ) @@ -557,10 +558,12 @@ async def chunk_context_endpoint(request: Request) -> JSONResponse: start = int(start_str) end = int(end_str) - chunk_index: int | None = ( - int(chunk_index_str) if chunk_index_str is not None else None - ) - total_chunks = int(total_chunks_str) if total_chunks_str is not None else 1 + chunk_index: int | None = None + if chunk_index_str is not None: + chunk_index = _parse_int_param( + chunk_index_str, 0, 0, 1000000, "chunk_index" + ) + total_chunks = _parse_int_param(total_chunks_str, 1, 1, 1000000, "total_chunks") # Convert doc_id to int (all document types use int IDs) doc_id_int = int(doc_id)