fix(backend): validate incoming plugin run input context against empty payloads#366
Open
annukumar123 wants to merge 2 commits into
Open
fix(backend): validate incoming plugin run input context against empty payloads#366annukumar123 wants to merge 2 commits into
annukumar123 wants to merge 2 commits into
Conversation
|
@annukumar123 is attempting to deploy a commit to the Darshan's projects Team on Vercel. A member of the Team first needs to authorize it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR addresses an input validation vulnerability across the backend plugin run router inside backend/routes/plugins.py.
The Problem: Previously, if a user submitted an empty string "" or whitespace-only inputs like " ", the text would bypass initial checks. This caused edge-case logic calculations to output erratic statistics (e.g., registering Sentences: 1 on an empty string inside the _wordcount plugin), executing unnecessary subprocess sandboxes, or writing meaningless telemetry logs to the database.
The Fix: Added a robust boundary validation check right at the entry point of the run_plugin route handler. If the stripped input string is empty, the server now halts execution immediately and raises a clean, structured HTTPException(status_code=400, detail="..."). This protects all downstream plugin functions and keeps server resources stable.
Hackathon Association
Program: Social Summer of Code (SSoC) 2026
Please label this PR with the appropriate SSoC difficulty tags (e.g., ssoc, level-1) so it registers for leaderboard points.