AOSSIE-Org / AOSSIE-Org/EduAid
[BUG]: Backend endpoints may crash when request body is empty or invalid JSON
- 主要言語
- JavaScript
- スター
- 171
- フォーク
- 423
- PR マージ指標
- 30日以内にマージされた PR はありません
説明
### Bug Description
Several backend API endpoints assume that `request.get_json()` always returns a valid dictionary.
Example pattern used in multiple routes:
```python
data = request.get_json()
input_text = data.get("input_text", "")
```
However, if a client sends an empty request body, invalid JSON, or an incorrect `Content-Type`, `request.get_json()` may return `None`. In that case, calling `data.get(...)` raises:
```
AttributeError: 'NoneType' object has no attribute 'get'
```
This causes the backend to return a 500 server error instead of a proper API error response. The API should handle such cases gracefully and return a structured JSON error (e.g., HTTP 400 Bad Request).
### Steps to Reproduce
1. Start the EduAid backend server locally.
2. Send a POST request to an endpoint such as `/get_mcq` without providing a JSON body.
Example request:
```
POST /get_mcq
Content-Type: application/json
```
Body:
```
(empty)
```
3. Alternatively, send an invalid JSON payload.
Example:
```
POST /get_mcq
Content-Type: application/json
```
Body:
```
invalid_json
```
4. Observe the server logs or API response.
The backend may raise an error similar to:
```
AttributeError: 'NoneType' object has no attribute 'get'
```
because `request.get_json()` returns `None` and the code attempts to access `data.get(...)`.
### Logs and Screenshots
Example server error observed when sending an empty or invalid JSON request:
```
AttributeError: 'NoneType' object has no attribute 'get'
```
Possible traceback example:
```
File "server.py", line XX, in get_mcq
input_text = data.get("input_text", "")
AttributeError: 'NoneType' object has no attribute 'get'
```
This happens because `request.get_json()` may return `None` when the request body is empty or contains invalid JSON.
No screenshot is attached because this issue can be reproduced easily using a simple POST request with an empty body.
### Environment Details
**Environment Details**
* **OS:** Windows 11
* **Python Version:** 3.10.x
* **Flask Version:** 2.x
* **Repository Branch:** `main`
* **Setup:** Local development environment (Flask backend running on `localhost:5000`)
**Additional Context**
The issue was observed while reviewing backend endpoints in `backend/server.py`.
Several routes directly access `data.get(...)` after calling `request.get_json()` without verifying whether the returned value is `None`.
This may cause backend crashes when clients send empty or malformed JSON requests.
### Impact
Critical - Application is unusable
### Code of Conduct
- [x] I have joined the [Discord server](https://discord.gg/hjUhu33uAn) and will post updates there
- [x] I have searched existing issues to avoid duplicates
コントリビューションガイド
このリポジトリのコントリビューションガイドは索引されていません
評価
この issue はまだ評価されていません。