AOSSIE-Org / AOSSIE-Org/EduAid

[BUG]: Backend endpoints may crash when request body is empty or invalid JSON

Đang mở
#577 0 bình luận 0 reaction 0 người được giao Xem trên GitHub
bug
Ngôn ngữ chính
JavaScript
Star
171
Fork
423
Chỉ số merge pull request
Không có pull request nào được merge trong 30 ngày

Mô tả

### Bug Description

Several backend API endpoints assume that `request.get_json()` always returns a valid dictionary.

Example pattern used in multiple routes:

```python
data = request.get_json()
input_text = data.get("input_text", "")
```

However, if a client sends an empty request body, invalid JSON, or an incorrect `Content-Type`, `request.get_json()` may return `None`. In that case, calling `data.get(...)` raises:

```
AttributeError: 'NoneType' object has no attribute 'get'
```

This causes the backend to return a 500 server error instead of a proper API error response. The API should handle such cases gracefully and return a structured JSON error (e.g., HTTP 400 Bad Request).

### Steps to Reproduce

1. Start the EduAid backend server locally.

2. Send a POST request to an endpoint such as `/get_mcq` without providing a JSON body.

Example request:

```
POST /get_mcq
Content-Type: application/json
```

Body:

```
(empty)
```

3. Alternatively, send an invalid JSON payload.

Example:

```
POST /get_mcq
Content-Type: application/json
```

Body:

```
invalid_json
```

4. Observe the server logs or API response.

The backend may raise an error similar to:

```
AttributeError: 'NoneType' object has no attribute 'get'
```

because `request.get_json()` returns `None` and the code attempts to access `data.get(...)`.

### Logs and Screenshots

Example server error observed when sending an empty or invalid JSON request:

```
AttributeError: 'NoneType' object has no attribute 'get'
```

Possible traceback example:

```
File "server.py", line XX, in get_mcq
input_text = data.get("input_text", "")
AttributeError: 'NoneType' object has no attribute 'get'
```

This happens because `request.get_json()` may return `None` when the request body is empty or contains invalid JSON.

No screenshot is attached because this issue can be reproduced easily using a simple POST request with an empty body.

### Environment Details

**Environment Details**

* **OS:** Windows 11
* **Python Version:** 3.10.x
* **Flask Version:** 2.x
* **Repository Branch:** `main`
* **Setup:** Local development environment (Flask backend running on `localhost:5000`)

**Additional Context**

The issue was observed while reviewing backend endpoints in `backend/server.py`.
Several routes directly access `data.get(...)` after calling `request.get_json()` without verifying whether the returned value is `None`.

This may cause backend crashes when clients send empty or malformed JSON requests.

### Impact

Critical - Application is unusable

### Code of Conduct

- [x] I have joined the [Discord server](https://discord.gg/hjUhu33uAn) and will post updates there
- [x] I have searched existing issues to avoid duplicates

Hướng dẫn đóng góp

Chưa lập chỉ mục được hướng dẫn đóng góp cho kho mã nguồn này

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.