Harden HTTP validation, error handling, and template management - #266
Closed
thomas9120 wants to merge 10 commits into
Closed
Harden HTTP validation, error handling, and template management#266thomas9120 wants to merge 10 commits into
thomas9120 wants to merge 10 commits into
Conversation
Suppress console window for llama.cpp runtime on Windows
Validate incoming HTTP bodies and origins: read_body now returns None for valid JSON that is not an object and get_request_content_length rejects Transfer-Encoding (501). Handlers return a 400 for malformed/invalid JSON. Harden get_request_host_origin against malformed Host ports (avoid ValueError). Use build_http_origin when composing URLs so IPv6 hosts are bracketed across backend services, tunnel args, app messages and the API tab UI. Also read preset files as UTF-8 and add/adjust unit tests and docs to cover these behaviors.
Print real exceptions to stderr and sanitize user-facing error text across several routes and services (hf_download, web_search, tunnel, status, file_picker). Move file-picker initial_dir.mkdir into the protected block so directory creation failures are handled and logged. Preserve existing config keys (e.g. external_chat_target) when rewriting config.json by loading, updating, and saving instead of overwriting. Update unit tests and docs to assert stderr logging and the preserved config behavior. Files touched: backend/routes/*, backend/services/*, tests/backend/*, and docs/code-review-2026-07-29.md.
Set Jinja templates default to enabled and add --no-jinja false_flag; remove unsupported apply_diff tool option. Enforce chat-template XOR so a custom template file wins over a builtin name and add UI handling to display unknown builtin template names in dropdowns. Use Number/Number.isFinite for numeric parsing (preserve exponent notation). Prevent stray empty assistant bubble on empty chat responses. Add console.debug to previously silent catches. Update frontend unit/e2e tests and sync AGENTS/docs to reflect fetchJson behavior and the other fixes.
Add two new docs: a full-repo code-review (code-review-swarm-2026-07-29.md) and its independent verification (code-review-swarm-2026-07-29-verification.md). Update tests/backend/test_services.py to supply an io.BytesIO as the HTTPError body and assert the body is closed after probing — preventing an open stream leak and aligning the test with expected cleanup behavior.
Multiple hardening fixes across backend and frontend: - backend: sanitize handler exceptions and track Response.started; bench route serializes wikitext2 extraction with .part file and size checks; hf download verifies Content-Length; send_input no longer holds process_lock, writes via bounded thread. - frontend: avoid clobbering focused flag/quick-launch inputs, pass force on wholesale flag applies, await stream aborts in chat, tolerate transient benchmark output failures. - Add .gitattributes eol pins and tests verifying the changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Significant bug fixes, first pass with more to come. Prepping for v2.0.0.