Fix(findrive): reject empty/whitespace content in upload_file before DB write#454
Open
Jean-Regis-M wants to merge 1 commit intoGenAI-Security-Project:mainfrom
Open
Fix(findrive): reject empty/whitespace content in upload_file before DB write#454Jean-Regis-M wants to merge 1 commit intoGenAI-Security-Project:mainfrom
Jean-Regis-M wants to merge 1 commit intoGenAI-Security-Project:mainfrom
Conversation
…_file
Root cause:
The max_size guard evaluated len(''.encode()) > max_size as False,
allowing empty content to pass through to repo.create_file() with
file_size=0 and blank content_text.
Solution:
Added presence check (not content or not content.strip()) immediately
before the size guard, returning an error dict on empty/whitespace input.
Impact:
Early return prevents any DB write; no existing valid-content paths
are affected; error response shape is consistent with existing guards.
Signed-off-by: JEAN REGIS <240509606@firat.edu.tr>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #367
Adds a content presence guard in
upload_fileto reject empty or whitespace-onlycontent before the size check and any database interaction occurs.
Problem
upload_fileinfinbot/mcp/servers/findrive/server.pyacceptedcontent=''silently and persisted a record with
file_size=0and blankcontent_text.The existing guard only checks the upper bound (file too large), not the
lower bound (file is empty):
When a downstream agent later calls
get_file, it receivesextracted_text: ""with no error signal a silent failure that can corrupt agent decision-making.
Root Cause
This occurs because the
max_sizeguard evaluateslen("".encode()) > max_sizeas
0 > 512000→False, which leads torepo.create_file()being reachedwith empty
content_textandfile_sizestored as0.Classification: Validation gap missing presence check before the size guard.
Solution
Two lines inserted immediately before the
max_sizeguard, insideupload_file:not contentcatches""andNonenot content.strip()catches whitespace-only strings (" ","\n\t", etc.)No other lines were modified.
Behaviour Comparison
content=""{"file_id": ..., "file_size": 0, "status": "uploaded"}{"error": "File content must not be empty"}content=" "{"file_id": ..., "file_size": 0, "status": "uploaded"}{"error": "File content must not be empty"}content="valid text"contentexceeds 500 KBImpact
repo.create_file()dict[str, Any]; error shape matches existing guardsTesting
Tasks
max_sizeguard0 > max_sizealways evaluatesFalse, bypassing validation entirelynot content or not content.strip()guard covering empty and whitespace-only inputsdb_sessionorrepo.create_file()callupload_filetest_fd_upload_008_empty_content_accepted_without_validationpassestest_fd_upload_001_upload_returns_file_id_and_metadatacontinues to pass