AOSSIE-Org / AOSSIE-Org/EduAid

[BUG]: Backend endpoints may crash when request body is empty or invalid JSON

Abierto
#577 0 comentarios 0 reacciones 0 asignados Ver en GitHub
bug
Lenguaje dominante
JavaScript
Estrellas
171
Forks
423
Métricas de merge de PR
Sin PR fusionados en 30 d

Descripción

### Bug Description

Several backend API endpoints assume that `request.get_json()` always returns a valid dictionary.

Example pattern used in multiple routes:

```python
data = request.get_json()
input_text = data.get("input_text", "")
```

However, if a client sends an empty request body, invalid JSON, or an incorrect `Content-Type`, `request.get_json()` may return `None`. In that case, calling `data.get(...)` raises:

```
AttributeError: 'NoneType' object has no attribute 'get'
```

This causes the backend to return a 500 server error instead of a proper API error response. The API should handle such cases gracefully and return a structured JSON error (e.g., HTTP 400 Bad Request).

### Steps to Reproduce

1. Start the EduAid backend server locally.

2. Send a POST request to an endpoint such as `/get_mcq` without providing a JSON body.

Example request:

```
POST /get_mcq
Content-Type: application/json
```

Body:

```
(empty)
```

3. Alternatively, send an invalid JSON payload.

Example:

```
POST /get_mcq
Content-Type: application/json
```

Body:

```
invalid_json
```

4. Observe the server logs or API response.

The backend may raise an error similar to:

```
AttributeError: 'NoneType' object has no attribute 'get'
```

because `request.get_json()` returns `None` and the code attempts to access `data.get(...)`.

### Logs and Screenshots

Example server error observed when sending an empty or invalid JSON request:

```
AttributeError: 'NoneType' object has no attribute 'get'
```

Possible traceback example:

```
File "server.py", line XX, in get_mcq
input_text = data.get("input_text", "")
AttributeError: 'NoneType' object has no attribute 'get'
```

This happens because `request.get_json()` may return `None` when the request body is empty or contains invalid JSON.

No screenshot is attached because this issue can be reproduced easily using a simple POST request with an empty body.

### Environment Details

**Environment Details**

* **OS:** Windows 11
* **Python Version:** 3.10.x
* **Flask Version:** 2.x
* **Repository Branch:** `main`
* **Setup:** Local development environment (Flask backend running on `localhost:5000`)

**Additional Context**

The issue was observed while reviewing backend endpoints in `backend/server.py`.
Several routes directly access `data.get(...)` after calling `request.get_json()` without verifying whether the returned value is `None`.

This may cause backend crashes when clients send empty or malformed JSON requests.

### Impact

Critical - Application is unusable

### Code of Conduct

- [x] I have joined the [Discord server](https://discord.gg/hjUhu33uAn) and will post updates there
- [x] I have searched existing issues to avoid duplicates

Guía de contribución

No hay ninguna guía de contribución indexada para este repositorio

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.