mirror of
https://github.com/paperless-ngx/paperless-ngx.git
synced 2026-06-30 09:14:17 +00:00
Trenton H
bb860a5834
* Fix: Validate and limit chat question input in ChatStreamingView Add max_length=4000 to ChatStreamingSerializer.q and replace the bare request.data["q"] read with proper serializer.is_valid(raise_exception=True) so oversized or missing questions are rejected with HTTP 400 before reaching the LLM. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Fix: Add defensive prompt framing to mark document content as untrusted * Also adds a system prompt which is treated higher that this is untrusted stuff --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
45 lines
1.4 KiB
Python
45 lines
1.4 KiB
Python
from __future__ import annotations
|
|
|
|
from unittest import mock
|
|
|
|
from django.contrib.auth.models import User
|
|
from rest_framework import status
|
|
from rest_framework.test import APITestCase
|
|
|
|
|
|
class TestChatStreamingViewInputValidation(APITestCase):
|
|
def setUp(self) -> None:
|
|
super().setUp()
|
|
self.user = User.objects.create_superuser(username="temp_admin")
|
|
self.client.force_authenticate(user=self.user)
|
|
|
|
def _mock_ai_enabled(self) -> mock.MagicMock:
|
|
"""Return a mock AIConfig instance with ai_enabled=True."""
|
|
m = mock.MagicMock()
|
|
m.ai_enabled = True
|
|
return m
|
|
|
|
def test_oversized_question_is_rejected(self) -> None:
|
|
with mock.patch(
|
|
"documents.views.AIConfig",
|
|
return_value=self._mock_ai_enabled(),
|
|
):
|
|
resp = self.client.post(
|
|
"/api/documents/chat/",
|
|
{"q": "x" * 4001},
|
|
format="json",
|
|
)
|
|
assert resp.status_code == status.HTTP_400_BAD_REQUEST
|
|
|
|
def test_missing_question_is_rejected(self) -> None:
|
|
with mock.patch(
|
|
"documents.views.AIConfig",
|
|
return_value=self._mock_ai_enabled(),
|
|
):
|
|
resp = self.client.post(
|
|
"/api/documents/chat/",
|
|
{},
|
|
format="json",
|
|
)
|
|
assert resp.status_code == status.HTTP_400_BAD_REQUEST
|