fix: add input validation for offset/limit to prevent query injection

Author: KhawarHabibKhan

code/backend/api/chat_history.py

@@ -55,7 +55,12 @@ async def list_conversations():
         return jsonify({"error": "Chat history is not available"}), 400
 
     try:
-        offset = request.args.get("offset", 0)
+        try:
+            offset = int(request.args.get("offset", 0))
+        except (ValueError, TypeError):
+            return jsonify({"error": "offset must be a valid integer"}), 400
+        if offset < 0:
+            return jsonify({"error": "offset must be non-negative"}), 400
         authenticated_user = get_authenticated_user_details(
             request_headers=request.headers
         )

code/backend/batch/utilities/chat_history/cosmosdb.py

@@ -122,8 +122,12 @@ async def delete_messages(self, conversation_id, user_id):
 
     async def get_conversations(self, user_id, limit, sort_order="DESC", offset=0):
         parameters = [{"name": "@userId", "value": user_id}]
+        if sort_order not in ("ASC", "DESC"):
+            sort_order = "DESC"
         query = f"SELECT * FROM c where c.userId = @userId and c.type='conversation' order by c.updatedAt {sort_order}"
         if limit is not None:
+            offset = int(offset)
+            limit = int(limit)
             query += f" offset {offset} limit {limit}"
 
         conversations = []