fix(script): bound maxRedirects to 100 and reject out of range values

docs/configuration.md

@@ -582,7 +582,7 @@ http(url, opts)
 | `body`         | string                      | `""`    | Request body                                                                                           |
 | `timeout`      | duration string (`"500ms"`) | `30s`   | Request timeout (the `timeout` config does not apply), applied to each hop when redirects are followed |
 | `insecure`     | boolean                     | `false` | Skip TLS verification (the `insecure` config does not apply)                                           |
-| `maxRedirects` | number                      | `0`     | How many redirects to follow, `0` follows none                                                         |
+| `maxRedirects` | number                      | `0`     | How many redirects to follow, `0` follows none, maximum 100                                            |
 
 Unknown options and values of the wrong type raise an error.
 

internal/script/http.go

@@ -63,6 +63,9 @@ type HTTPDoer interface {
 // httpDefaultMethod is used when the options set no method.
 const httpDefaultMethod = http.MethodGet
 
+// httpMaxRedirectsLimit is the highest maxRedirects a script may ask for.
+const httpMaxRedirectsLimit = 100
+
 // Option keys accepted by the http function.
 const (
 	httpOptionMethod       = "method"
@@ -103,10 +106,13 @@ func (b *httpBridge) do(req *HTTPRequest) (*HTTPResponse, error) {
 // It can return the following errors:
 //   - types.ScriptHTTPOptionError
 func parseHTTPMaxRedirects(count float64) (int, error) {
-	if count < 0 || count != math.Trunc(count) {
+	if math.IsNaN(count) || count < 0 || count > httpMaxRedirectsLimit || count != math.Trunc(count) {
 		return 0, types.NewScriptHTTPOptionError(
 			httpOptionMaxRedirects,
-			types.NewScriptTypeError("a whole number of 0 or more", strconv.FormatFloat(count, 'f', -1, 64)),
+			types.NewScriptTypeError(
+				"a whole number between 0 and "+strconv.Itoa(httpMaxRedirectsLimit),
+				strconv.FormatFloat(count, 'g', -1, 64),
+			),
 		)
 	}
 	return int(count), nil