Avoid paging links when offset is artificially set very high

hapi-fhir-jpaserver-base/src/test/java/ca/uhn/fhir/jpa/provider/r4/ResourceProviderR4Test.java

@@ -157,6 +157,35 @@ public class ResourceProviderR4Test extends BaseResourceProviderR4Test {
 	}
 
 
+	@Test
+	public void testManualPagingLinkOffsetDoesntReturnBeyondEnd() {
+		myDaoConfig.setSearchPreFetchThresholds(Lists.newArrayList(10, 1000));
+
+		for (int i = 0; i < 50; i++) {
+			Organization o = new Organization();
+			o.setId("O" + i);
+			o.setName("O" + i);
+			ourClient.update().resource(o).execute().getId().toUnqualifiedVersionless();
+		}
+
+		Bundle output = ourClient
+			.search()
+			.forResource("Organization")
+			.count(3)
+			.returnBundle(Bundle.class)
+			.execute();
+
+		ourLog.info(myFhirCtx.newJsonParser().setPrettyPrint(true).encodeResourceToString(output));
+
+		String linkNext = output.getLink("next").getUrl();
+		linkNext = linkNext.replaceAll("_getpagesoffset=[0-9]+", "_getpagesoffset=3300");
+		assertThat(linkNext, containsString("_getpagesoffset=3300"));
+
+		Bundle nextPageBundle = ourClient.loadPage().byUrl(linkNext).andReturnBundle(Bundle.class).execute();
+		ourLog.info(myFhirCtx.newJsonParser().setPrettyPrint(true).encodeResourceToString(nextPageBundle));
+		assertEquals(null, nextPageBundle.getLink("next"));
+	}
+
 	@Test
 	public void testSearchLinksWorkWithIncludes() {
 		for (int i = 0; i < 5; i++) {

hapi-fhir-server/src/main/java/ca/uhn/fhir/rest/server/method/BaseResourceReturningMethodBinding.java

@@ -142,6 +142,10 @@ public abstract class BaseResourceReturningMethodBinding extends BaseMethodBindi
 			}
 			RestfulServerUtils.validateResourceListNotNull(resourceList);
 
+			if (numTotalResults == null) {
+				numTotalResults = theResult.size();
+			}
+
 			if (theSearchId != null) {
 				searchId = theSearchId;
 			} else {
@@ -198,7 +202,13 @@ public abstract class BaseResourceReturningMethodBinding extends BaseMethodBindi
 				linkPrev = RestfulServerUtils.createPagingLink(theIncludes, theRequest, searchId, theResult.getPreviousPageId(), theRequest.getParameters(), prettyPrint, theBundleType);
 			}
 		} else if (searchId != null) {
-			// We're doing offset pages
+			/*
+			 * We're doing offset pages - Note that we only return paging links if we actually
+			 * included some results in the response. We do this to avoid situations where
+			 * people have faked the offset number to some huge number to avoid them getting
+			 * back paging links that don't make sense.
+			 */
+			if (resourceList.size() > 0) {
 				if (numTotalResults == null || theOffset + numToReturn < numTotalResults) {
 					linkNext = (RestfulServerUtils.createPagingLink(theIncludes, theRequest, searchId, theOffset + numToReturn, numToReturn, theRequest.getParameters(), prettyPrint, theBundleType));
 				}
@@ -207,6 +217,7 @@ public abstract class BaseResourceReturningMethodBinding extends BaseMethodBindi
 					linkPrev = RestfulServerUtils.createPagingLink(theIncludes, theRequest, searchId, start, theLimit, theRequest.getParameters(), prettyPrint, theBundleType);
 				}
 			}
+		}
 
 		bundleFactory.addRootPropertiesToBundle(theResult.getUuid(), serverBase, theLinkSelf, linkPrev, linkNext, theResult.size(), theBundleType, theResult.getPublished());
 		bundleFactory.addResourcesToBundle(new ArrayList<>(resourceList), theBundleType, serverBase, theServer.getBundleInclusionRule(), theIncludes);