AOSSIE-Org / AOSSIE-Org/EduAid

[BUG]: Backend endpoints may crash when request body is empty or invalid JSON

オープン
#577 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る
bug
主要言語
JavaScript
スター
171
フォーク
423
PR マージ指標
30日以内にマージされた PR はありません

説明

### Bug Description

Several backend API endpoints assume that `request.get_json()` always returns a valid dictionary.

Example pattern used in multiple routes:

```python
data = request.get_json()
input_text = data.get("input_text", "")
```

However, if a client sends an empty request body, invalid JSON, or an incorrect `Content-Type`, `request.get_json()` may return `None`. In that case, calling `data.get(...)` raises:

```
AttributeError: 'NoneType' object has no attribute 'get'
```

This causes the backend to return a 500 server error instead of a proper API error response. The API should handle such cases gracefully and return a structured JSON error (e.g., HTTP 400 Bad Request).

### Steps to Reproduce

1. Start the EduAid backend server locally.

2. Send a POST request to an endpoint such as `/get_mcq` without providing a JSON body.

Example request:

```
POST /get_mcq
Content-Type: application/json
```

Body:

```
(empty)
```

3. Alternatively, send an invalid JSON payload.

Example:

```
POST /get_mcq
Content-Type: application/json
```

Body:

```
invalid_json
```

4. Observe the server logs or API response.

The backend may raise an error similar to:

```
AttributeError: 'NoneType' object has no attribute 'get'
```

because `request.get_json()` returns `None` and the code attempts to access `data.get(...)`.

### Logs and Screenshots

Example server error observed when sending an empty or invalid JSON request:

```
AttributeError: 'NoneType' object has no attribute 'get'
```

Possible traceback example:

```
File "server.py", line XX, in get_mcq
input_text = data.get("input_text", "")
AttributeError: 'NoneType' object has no attribute 'get'
```

This happens because `request.get_json()` may return `None` when the request body is empty or contains invalid JSON.

No screenshot is attached because this issue can be reproduced easily using a simple POST request with an empty body.

### Environment Details

**Environment Details**

* **OS:** Windows 11
* **Python Version:** 3.10.x
* **Flask Version:** 2.x
* **Repository Branch:** `main`
* **Setup:** Local development environment (Flask backend running on `localhost:5000`)

**Additional Context**

The issue was observed while reviewing backend endpoints in `backend/server.py`.
Several routes directly access `data.get(...)` after calling `request.get_json()` without verifying whether the returned value is `None`.

This may cause backend crashes when clients send empty or malformed JSON requests.

### Impact

Critical - Application is unusable

### Code of Conduct

- [x] I have joined the [Discord server](https://discord.gg/hjUhu33uAn) and will post updates there
- [x] I have searched existing issues to avoid duplicates

コントリビューションガイド

このリポジトリのコントリビューションガイドは索引されていません

評価

この issue はまだ評価されていません。

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。