Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fastapi parameter validation #1326

Merged
merged 6 commits into from
Sep 13, 2024
Merged

Fastapi parameter validation #1326

merged 6 commits into from
Sep 13, 2024

Conversation

dokterbob
Copy link
Collaborator

@dokterbob dokterbob commented Sep 9, 2024

Validate path hierarchy and path parameters for:

  • get_avatar
  • `project_settings
  • project_translations

Includes test coverage for all relevant methods.

* Regression test for file traversal bug in `project_translations`.
* Regression test for `project_settings` path traversal vulnerability.
* Regression test for path traversal vulnerability in `get_avatar()`.
@dokterbob dokterbob force-pushed the fastapi_parameter_validation branch from 6fe8d85 to 51baf5b Compare September 9, 2024 16:09
@dokterbob dokterbob force-pushed the fastapi_parameter_validation branch 3 times, most recently from 763bae3 to 92c780d Compare September 9, 2024 22:32
* Must build frontend for backend tests... (for now).
* Follow ISO spec on Klingon matters.
@dokterbob dokterbob force-pushed the fastapi_parameter_validation branch from 38e826c to 54f79d7 Compare September 9, 2024 22:56
@dokterbob dokterbob marked this pull request as ready for review September 9, 2024 22:56
Copy link
Collaborator

@willydouhard willydouhard left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@dokterbob dokterbob merged commit 0f7aad5 into main Sep 13, 2024
16 checks passed
@dokterbob dokterbob deleted the fastapi_parameter_validation branch September 13, 2024 11:22

def test_get_avatar_custom(test_client: TestClient, monkeypatch: pytest.MonkeyPatch):
"""Test with custom avatar."""
custom_avatar_path = os.path.join(

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dokterbob this is assuming that the avatar will be called with correctly which is not the case for the chat. If the assistant name contains space, it will call the API passing that name from the UI and it will return a 400.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants