From 00c35fcce6dc11074d2e42590161ed1bf05d0850 Mon Sep 17 00:00:00 2001 From: xbzz1018 Date: Mon, 28 Sep 2026 15:17:41 +0800 Subject: [PATCH] fix(uploads): reject boolean upload limits (#5920) Signed-off-by: xbzz1018 Co-authored-by: xbzz1018 --- backend/app/gateway/routers/uploads.py | 2 ++ backend/tests/test_uploads_router.py | 17 +++++++++++++++++ 2 files changed, 19 insertions(+) diff --git a/backend/app/gateway/routers/uploads.py b/backend/app/gateway/routers/uploads.py index a6f2374515..449f8cd630 100644 --- a/backend/app/gateway/routers/uploads.py +++ b/backend/app/gateway/routers/uploads.py @@ -163,6 +163,8 @@ def _get_upload_limit(app_config: AppConfig, key: str, default: int, *, legacy_k value = _get_uploads_config_value(app_config, legacy_key, None) if value is None: value = default + if isinstance(value, bool): + raise ValueError limit = int(value) if limit <= 0: raise ValueError diff --git a/backend/tests/test_uploads_router.py b/backend/tests/test_uploads_router.py index bcf1a683eb..4c4f19c2a5 100644 --- a/backend/tests/test_uploads_router.py +++ b/backend/tests/test_uploads_router.py @@ -1646,6 +1646,23 @@ def test_upload_limits_accept_legacy_config_keys(): assert limits == uploads.UploadLimits(max_files=7, max_file_size=123, max_total_size=456) +@pytest.mark.parametrize( + ("key", "default"), + [ + ("max_files", uploads.DEFAULT_MAX_FILES), + ("max_file_size", uploads.DEFAULT_MAX_FILE_SIZE), + ("max_total_size", uploads.DEFAULT_MAX_TOTAL_SIZE), + ], +) +def test_upload_limits_reject_boolean_values(key, default): + cfg = MagicMock() + cfg.uploads = {key: True} + + limits = uploads._get_upload_limits(cfg) + + assert getattr(limits, key) == default + + def test_upload_files_uses_configured_file_count_limit(tmp_path): thread_uploads_dir = tmp_path / "uploads" thread_uploads_dir.mkdir(parents=True)