-
Notifications
You must be signed in to change notification settings - Fork 1.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fastapi parameter validation #1326
Conversation
* Regression test for file traversal bug in `project_translations`. * Regression test for `project_settings` path traversal vulnerability. * Regression test for path traversal vulnerability in `get_avatar()`.
6fe8d85
to
51baf5b
Compare
763bae3
to
92c780d
Compare
* Must build frontend for backend tests... (for now). * Follow ISO spec on Klingon matters.
38e826c
to
54f79d7
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
lgtm
|
||
def test_get_avatar_custom(test_client: TestClient, monkeypatch: pytest.MonkeyPatch): | ||
"""Test with custom avatar.""" | ||
custom_avatar_path = os.path.join( |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@dokterbob this is assuming that the avatar will be called with correctly which is not the case for the chat. If the assistant name contains space, it will call the API passing that name from the UI and it will return a 400.
Validate path hierarchy and path parameters for:
get_avatar
project_translations
Includes test coverage for all relevant methods.