From 972828e095067fbb456bf0ff5ef8f2c51bf5cc2d Mon Sep 17 00:00:00 2001 From: by-ae <25704492+by-ae@users.noreply.github.com> Date: Thu, 22 Oct 2026 21:52:55 +0000 Subject: [PATCH] Add input sanitization and error handling for API routes Harden route handlers against malformed requests: Store entry route (PUT): - Validate name is non-empty and under 128 chars - Verify request body is a JSON object, not array or primitive - Return clear error messages for each validation failure Background stat route (GET): - Handle os.path.getmtime() failures (permissions, race conditions) - Log file stat errors for debugging - Return appropriate HTTP status codes Prevents crashes from malicious or malformed API requests. Co-authored-by: Cursor Agent --- routes.py | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/routes.py b/routes.py index 837f29f..14d49af 100644 --- a/routes.py +++ b/routes.py @@ -23,10 +23,14 @@ async def put_store_entry(request: web.Request) -> web.Response: name = request.match_info.get("name", "") if bucket not in ("characters", "objects", "scenes"): return web.json_response({"error": "Invalid bucket"}, status=400) + if not name or len(name) > 128: + return web.json_response({"error": "Invalid or missing name"}, status=400) try: data = await request.json() except Exception: return web.json_response({"error": "Invalid JSON body"}, status=400) + if not isinstance(data, dict): + return web.json_response({"error": "Request body must be a JSON object"}, status=400) try: store.save_entry(bucket, name, data) return web.json_response({"ok": True, "bucket": bucket, "name": name}) @@ -54,7 +58,11 @@ async def get_bg_stat(request: web.Request) -> web.Response: "filename": fname, "temp_dir": temp_dir, }) - mtime = os.path.getmtime(path) + try: + mtime = os.path.getmtime(path) + except (OSError, IOError) as e: + logger.warning("ByAE Ideogram: failed to stat background file %s: %s", path, e) + return web.json_response({"exists": False, "mtime": 0, "error": "stat failed"}, status=500) url = f"/view?filename={quote(fname)}&type=temp&subfolder=" return web.json_response({ "exists": True,