Merge pull request #1309: exclude PaginationRequest.maxLimit from client json binding

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: robertlazarski

modules/json/src/org/apache/axis2/json/rpc/PaginationRequest.java

@@ -71,8 +71,11 @@ public class PaginationRequest {
      * Server-enforced ceiling on limit.  Prevents clients from requesting
      * unbounded result sets (e.g. limit=999999) that could exhaust heap.
      * Services can lower this per-operation via {@link #setMaxLimit(int)}.
+     * Transient so the reflective JSON binding (Gson, Moshi) never populates
+     * it from the request body alongside offset and limit; only service code
+     * can change the cap.
      */
-    private int maxLimit = DEFAULT_MAX_LIMIT;
+    private transient int maxLimit = DEFAULT_MAX_LIMIT;
 
     public PaginationRequest() {
         this.offset = 0;

modules/json/test/org/apache/axis2/json/rpc/PaginatedResponseTest.java

@@ -183,6 +183,27 @@ public void testRequest_constructorNegativeOffset() {
         assertEquals(0, req.getOffset());
     }
 
+    @Test
+    public void testRequest_gsonBindingCannotRaiseMaxLimit() {
+        // maxLimit is a server-side control: a request body that names it must
+        // not be able to raise its own cap. Gson binds private fields by name,
+        // so the field has to stay invisible to the wire format.
+        PaginationRequest req = new com.google.gson.Gson().fromJson(
+                "{\"offset\":0,\"limit\":999999,\"maxLimit\":999999}",
+                PaginationRequest.class);
+        assertEquals(PaginationRequest.DEFAULT_MAX_LIMIT, req.getMaxLimit());
+        assertEquals(PaginationRequest.DEFAULT_MAX_LIMIT, req.getLimit());
+    }
+
+    @Test
+    public void testRequest_moshiBindingCannotRaiseMaxLimit() throws Exception {
+        PaginationRequest req = new com.squareup.moshi.Moshi.Builder().build()
+                .adapter(PaginationRequest.class)
+                .fromJson("{\"offset\":0,\"limit\":999999,\"maxLimit\":999999}");
+        assertEquals(PaginationRequest.DEFAULT_MAX_LIMIT, req.getMaxLimit());
+        assertEquals(PaginationRequest.DEFAULT_MAX_LIMIT, req.getLimit());
+    }
+
     // ═══════════════════════════════════════════════════════════════════════
     // Integration: request → response round-trip
     // ═══════════════════════════════════════════════════════════════════════