Fix(findrive): reject empty/whitespace content in upload_file before DB write#472
Closed
Jean-Regis-M wants to merge 1 commit intoGenAI-Security-Project:mainfrom
Closed
Fix(findrive): reject empty/whitespace content in upload_file before DB write#472Jean-Regis-M wants to merge 1 commit intoGenAI-Security-Project:mainfrom
Jean-Regis-M wants to merge 1 commit intoGenAI-Security-Project:mainfrom
Conversation
…_file
Root cause:
The max_size guard evaluated len(''.encode()) > max_size as False,
allowing empty content to pass through to repo.create_file() with
file_size=0 and blank content_text.
Solution:
Added presence check (not content or not content.strip()) immediately
before the size guard, returning an error dict on empty/whitespace input.
Impact:
Early return prevents any DB write; no existing valid-content paths
are affected; error response shape is consistent with existing guards.
Signed-off-by: JEAN REGIS <240509606@firat.edu.tr>
Contributor
|
@Jean-Regis-M Hey, just wanted to flag that this PR references Fixes #268 but that issue is about InvoiceCountEvaluator sharing badge progress across users - unrelated to this fix. Based on the description and the test name test_fd_upload_008, this actually fixes #367 (FD-UPLOAD-008: Empty content accepted; file_size stored as 0). Could you update the PR description to reference the correct issue? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #367
upload_fileaccepted empty and whitespace-only content, persistinga record with
content_text=""andfile_size=0, causing silent failures whenagents read the file back.
Problem
The only guard in
upload_fileis an upper-bound size check:For
content="",len("".encode())evaluates to0, so0 > max_sizeisalways
False. The call falls through torepo.create_file()with blankcontent_textandfile_size=0written to the database with no error raised.When an agent later calls
get_file, it receivesextracted_text: ""noerror, no signal, just empty content entering the LLM context window silently.
Root Cause
len("".encode("utf-8")) > max_size→0 > 512000→False.The size guard is an upper-bound check only. There is no lower-bound presence
check, so empty and whitespace-only strings pass validation entirely and reach
repo.create_file()unconditionally.Classification: Validation gap missing content presence check before the size guard.
Fix
Two lines added immediately before the
max_sizeguard inupload_file:not contentcatches""andNonenot content.strip()catches whitespace-only strings (" ","\n\t")db_sessionis opened no DB write occurs on invalid inputZero other lines touched.
Behaviour
content=""file_size=0{"error": "File content must not be empty"}content=" \n"file_size=0{"error": "File content must not be empty"}content="invoice text..."contentexceeds 500 KBTesting
Tasks
0 > max_sizealways evaluatesFalsefor empty inputrepo.create_file()was reachednot content or not content.strip()guard covering both empty and whitespace-only casesdb_sessionopen, no DB interaction occurs on invalid inputupload_filetest_fd_upload_008passes empty content now correctly rejectedtest_fd_upload_001passes valid upload path fully intact