Sanitize limit values

1 files changed, 5 insertions, 3 deletions

diff --git a/lib/app.js b/lib/app.js
index b0b92ee..b5140e1 100644
--- a/lib/app.js
+++ b/lib/app.js
@@ -354,12 +354,13 @@ App.prototype.createLogStream = function (opts) {
 
 App.prototype.createFeedStream = function (opts) {
   // work around opts.gt being treated as opts.gte sometimes
+  var limit = Number(opts.limit)
   if (opts.gt && opts.limit && !opts.reverse) return pull(
     this.sbot.createFeedStream(u.mergeOpts(opts, {limit: opts.limit + 1})),
     pull.filter(function (msg) {
       return msg && msg.value.timestamp !== opts.gt
     }),
-    opts.limit && pull.take(opts.limit)
+    limit && pull.take(limit)
   )
   return this.sbot.createFeedStream(opts)
 }
@@ -551,6 +552,7 @@ App.prototype.streamEmojis = function () {
 App.prototype.filter = function (plugin, opts, filter) {
   // work around flumeview-query not picking the best index.
   // %b+QdyLFQ21UGYwvV3AiD8FEr7mKlB8w9xx3h8WzSUb0=.sha256
+  var limit = Number(opts.limit)
   var index
   if (plugin === this.sbot.backlinks) {
     var c = filter && filter.value && filter.value.content
@@ -563,7 +565,7 @@ App.prototype.filter = function (plugin, opts, filter) {
     plugin.read({
       index: index,
       reverse: opts.reverse,
-      limit: opts.limit && (opts.limit + 1),
+      limit: limit && (limit + 1),
       query: [{$filter: u.mergeOpts(filter, {
         timestamp: {
           $gte: opts.gt,
@@ -574,7 +576,7 @@ App.prototype.filter = function (plugin, opts, filter) {
     pull.filter(function (msg) {
       return msg && msg.timestamp !== opts.lt && msg.timestamp !== opts.gt
     }),
-    opts.limit && pull.take(opts.limit)
+    limit && pull.take(limit)
   )
 }