fix: additional input validation for CVE graphQL query (#2408)

It is possible to ask for a very large limit size which can exhaust
memory.

Signed-off-by: Ramkumar Chinchani <rchincha@cisco.com>

pkg/extensions/search/cve/pagination.go

@@ -62,6 +62,8 @@ type CvePageFinder struct {
 	pageBuffer []cvemodel.CVE
 }
 
+const maxCvePageLimit = 4 * 1024
+
 func NewCvePageFinder(limit, offset int, sortBy cvemodel.SortCriteria) (*CvePageFinder, error) {
 	if sortBy == "" {
 		sortBy = SeverityDsc
@@ -71,6 +73,10 @@ func NewCvePageFinder(limit, offset int, sortBy cvemodel.SortCriteria) (*CvePage
 		return nil, zerr.ErrLimitIsNegative
 	}
 
+	if limit > maxCvePageLimit {
+		return nil, zerr.ErrLimitIsExcessive
+	}
+
 	if offset < 0 {
 		return nil, zerr.ErrOffsetIsNegative
 	}

pkg/extensions/search/cve/pagination_test.go

@@ -415,6 +415,23 @@ func TestCVEPagination(t *testing.T) {
 					previousSeverity = severityToInt[cve.Severity]
 				}
 			})
+			Convey("bad limits", func() {
+				_, _, _, err := cveInfo.GetCVEListForImage(ctx, "repo1", "0.1.0", "", "", "", cvemodel.PageInput{
+					Limit:  -1,
+					Offset: 3,
+					SortBy: cveinfo.AlphabeticAsc,
+				},
+				)
+				So(err, ShouldNotBeNil)
+
+				_, _, _, err = cveInfo.GetCVEListForImage(ctx, "repo1", "0.1.0", "", "", "", cvemodel.PageInput{
+					Limit:  4097,
+					Offset: 3,
+					SortBy: cveinfo.AlphabeticAsc,
+				},
+				)
+				So(err, ShouldNotBeNil)
+			})
 		})
 	})
 }