fix(api): Reject negative pagination cursors

src/sentry/api/paginator.py

@@ -536,6 +536,9 @@ def __init__(self, data_fn):
     def get_result(self, limit, cursor=None):
         assert limit > 0
         offset = cursor.offset if cursor is not None else 0
+        if offset < 0:
+            raise BadPaginationError("Pagination offset cannot be negative")
+
         # Request 1 more than limit so we can tell if there is another page
         data = self.data_fn(offset=offset, limit=limit + 1)
 

tests/sentry/api/test_base.py

@@ -483,6 +483,11 @@ def test_invalid_cursor(self) -> None:
         response = self.view(request)
         assert response.status_code == 400
 
+    def test_negative_cursor(self) -> None:
+        request = self.make_request(GET={"cursor": "0:-1:0"})
+        response = self.view(request)
+        assert response.status_code == 400
+
     def test_non_int_per_page(self) -> None:
         request = self.make_request(GET={"per_page": "nope"})
         response = self.view(request)