Respect maximum_page_limit in batch list endpoints - #73409
Open
Eason09053360 wants to merge 1 commit into
Open
Eason09053360 wants to merge 1 commit into
Eason09053360 wants to merge 1 commit into
Conversation
The `[api] maximum_page_limit` cap is documented as applying to any limit a client asks for, but it was only enforced on the query-parameter path, inside `LimitFilter.depends`. The two batch endpoints read their page size from a request body, so FastAPI never invokes that dependency and the cap was never applied — an authenticated client could ask these two endpoints for the whole table while the equivalent GET endpoints capped the same request. Giving the clamp its own name lets both entry points share one definition, so they cannot disagree about the setting again.
Eason09053360
requested review from
bugraoz93,
choo121600,
ephraimbuddy,
henry3260,
jason810496,
pierrejeambrun,
rawwar and
shubhamraj-git
as code owners
September 20, 2026 15:07
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
[api] maximum_page_limitis documented as capping any limit a client asks for, but was only enforced insideLimitFilter.depends, on the query-parameter path. The two batch endpoints (POST /dags/~/dagRuns/list,POST /dags/~/dagRuns/~/taskInstances/list) read their page size from a request body, so FastAPI never invokes that dependency — an authenticated client could ask them for the whole table while the equivalent GET endpoints capped the same request. The cap arrived in #60989, which missed these two call sites.What
LimitFilter.clamp_to_maximumincommon/parameters/base.py;dependsdelegates to it, so both entry points share one definition.LimitFilterthrough it.total_entriesreports the larger unclamped count; both fail without the fix.Was generative AI tooling used to co-author this PR?
Generated-by: Claude Code (Opus 5) following the guidelines