MEDIUM: No Request Validation on Web UI API #9

New Issue

Koko210 · 2026-02-16T22:09:38+02:00

Koko210 commented

2026-02-16 22:09:38 +02:00

The web API endpoints (bot/api.py) do not validate incoming request parameters, allowing invalid or malicious data to reach the bot logic.

Where It Occurs

bot/api.py - All API endpoints missing validation
bot/api_main.py - API routes

Why This Is a Problem

Security: Malformed input may cause crashes or unexpected behavior
Data Corruption: Invalid data may be written to state files
Poor UX: Users get cryptic errors instead of helpful messages
Debugging: Hard to trace issues without validation

What Can Go Wrong

Scenario 1: Negative GPU Index

User sends POST /api/set_gpu with body {gpu_index: -1}
API endpoint does not validate gpu_index >= 0
Code tries to access array with negative index
IndexError causes API to return 500 error
User gets no helpful error message

Scenario 2: Large Message Payload

User sends POST /api/message with 10MB body
API does not validate payload size
Bot tries to process entire message
Memory consumption spikes
Bot crashes or slows down dramatically

Proposed Fix

Use Pydantic for request validation with schema definitions.

Severity

MEDIUM - Lack of validation causes crashes and poor error messages.

Files Affected

bot/api.py, bot/api_main.py

The web API endpoints (bot/api.py) do not validate incoming request parameters, allowing invalid or malicious data to reach the bot logic. ## Where It Occurs - bot/api.py - All API endpoints missing validation - bot/api_main.py - API routes ## Why This Is a Problem 1. Security: Malformed input may cause crashes or unexpected behavior 2. Data Corruption: Invalid data may be written to state files 3. Poor UX: Users get cryptic errors instead of helpful messages 4. Debugging: Hard to trace issues without validation ## What Can Go Wrong ### Scenario 1: Negative GPU Index 1. User sends POST /api/set_gpu with body {gpu_index: -1} 2. API endpoint does not validate gpu_index >= 0 3. Code tries to access array with negative index 4. IndexError causes API to return 500 error 5. User gets no helpful error message ### Scenario 2: Large Message Payload 1. User sends POST /api/message with 10MB body 2. API does not validate payload size 3. Bot tries to process entire message 4. Memory consumption spikes 5. Bot crashes or slows down dramatically ## Proposed Fix Use Pydantic for request validation with schema definitions. ## Severity MEDIUM - Lack of validation causes crashes and poor error messages. ## Files Affected bot/api.py, bot/api_main.py

Koko210 closed this issue

2026-02-16 22:16:33 +02:00

Koko210 reopened this issue

2026-02-16 22:17:02 +02:00

Koko210 referenced this issue from a commit

2026-02-23 13:31:38 +02:00

fix(P1): 6 priority-1 bug fixes for autonomous engine and mood system

Sign in to join this conversation.