From 92f806788e09297d1924d48c1f4a930c87dcc5fc Mon Sep 17 00:00:00 2001 From: Max Ostapenko <1611259+max-ostapenko@users.noreply.github.com> Date: Sat, 12 Jul 2025 21:02:07 +0200 Subject: [PATCH 1/6] safe int --- server/routes.py | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/server/routes.py b/server/routes.py index 2013756c..e9b13122 100644 --- a/server/routes.py +++ b/server/routes.py @@ -8,6 +8,16 @@ from . import faq as faq_util +def safe_int(value, default=1): + """ + Safely convert a value to integer, default to 1 if conversion fails. + """ + try: + return int(value) if value else default + except (ValueError, TypeError): + return default + + @app.route("/") def index(): return render_template( @@ -89,11 +99,9 @@ def techreportlanding(page_id): requested_geo = request.args.get("geo") or "ALL" requested_rank = request.args.get("rank") or "ALL" requested_category = request.args.get("category") or "CMS" - requested_page = request.args.get("page") or 1 - requested_page = int(requested_page) + requested_page = safe_int(request.args.get("page")) selected_techs = request.args.get("selected") - selected_rows = request.args.get("rows") or 10 - selected_rows = str(selected_rows) + selected_rows = str(safe_int(request.args.get("rows"), default=10)) last_page = request.args.get("last_page") or False From c8e64db29e69c3cd4dddc56bacb9da5c98c27e07 Mon Sep 17 00:00:00 2001 From: Max Ostapenko <1611259+max-ostapenko@users.noreply.github.com> Date: Sat, 12 Jul 2025 21:13:58 +0200 Subject: [PATCH 2/6] tests --- server/tests/routes_test.py | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/server/tests/routes_test.py b/server/tests/routes_test.py index 9a98822c..09e7ed31 100644 --- a/server/tests/routes_test.py +++ b/server/tests/routes_test.py @@ -243,6 +243,16 @@ def test_tech_report_category(client): assert response.status_code == 200 +def test_tech_report_category_pages(client): + response = client.get("/reports/techreport/category?geo=ALL&rank=ALL&category=CMS&page=2") + assert response.status_code == 200 + + +def test_tech_report_category_pages_fallback(client): + response = client.get("/reports/techreport/category?geo=ALL&rank=ALL&category=CMS&page=defaults_to_1") + assert response.status_code == 200 + + def test_well_known_atproto_did(client): response = client.get("/.well-known/atproto-did") assert response.status_code == 200 From 814e2d38b15737d30fdfb320e1011979ff58b7f8 Mon Sep 17 00:00:00 2001 From: Max Ostapenko <1611259+max-ostapenko@users.noreply.github.com> Date: Sat, 12 Jul 2025 23:30:57 +0200 Subject: [PATCH 3/6] lint --- server/tests/routes_test.py | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/server/tests/routes_test.py b/server/tests/routes_test.py index e089efa6..799caff8 100644 --- a/server/tests/routes_test.py +++ b/server/tests/routes_test.py @@ -234,9 +234,7 @@ def test_tech_report_drilldown(client): def test_tech_report_drilldown_wordpress(client): - response = client.get( - "/reports/techreport/tech?tech=WordPress&geo=ALL&rank=ALL" - ) + response = client.get("/reports/techreport/tech?tech=WordPress&geo=ALL&rank=ALL") assert response.status_code == 200 @@ -248,12 +246,16 @@ def test_tech_report_category(client): def test_tech_report_category_pages(client): - response = client.get("/reports/techreport/category?geo=ALL&rank=ALL&category=CMS&page=2") + response = client.get( + "/reports/techreport/category?geo=ALL&rank=ALL&category=CMS&page=2" + ) assert response.status_code == 200 def test_tech_report_category_pages_fallback(client): - response = client.get("/reports/techreport/category?geo=ALL&rank=ALL&category=CMS&page=defaults_to_1") + response = client.get( + "/reports/techreport/category?geo=ALL&rank=ALL&category=CMS&page=defaults_to_1" + ) assert response.status_code == 200 From 22b47203250e04086fe65e17c4e7728b4f620fb0 Mon Sep 17 00:00:00 2001 From: Max Ostapenko <1611259+max-ostapenko@users.noreply.github.com> Date: Sat, 12 Jul 2025 23:55:49 +0200 Subject: [PATCH 4/6] revert --- server/tests/routes_test.py | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/server/tests/routes_test.py b/server/tests/routes_test.py index 799caff8..51c2303d 100644 --- a/server/tests/routes_test.py +++ b/server/tests/routes_test.py @@ -239,9 +239,7 @@ def test_tech_report_drilldown_wordpress(client): def test_tech_report_category(client): - response = client.get( - "/reports/techreport/category?geo=ALL&rank=ALL&category=CMS" - ) + response = client.get("/reports/techreport/category?geo=ALL&rank=ALL&category=CMS") assert response.status_code == 200 From 2b8974f95657a19f35dda5ae37ef407be55ee5e2 Mon Sep 17 00:00:00 2001 From: Max Ostapenko <1611259+max-ostapenko@users.noreply.github.com> Date: Mon, 14 Jul 2025 12:34:25 +0200 Subject: [PATCH 5/6] todo --- server/routes.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/routes.py b/server/routes.py index e9b13122..be2a0cc9 100644 --- a/server/routes.py +++ b/server/routes.py @@ -99,7 +99,7 @@ def techreportlanding(page_id): requested_geo = request.args.get("geo") or "ALL" requested_rank = request.args.get("rank") or "ALL" requested_category = request.args.get("category") or "CMS" - requested_page = safe_int(request.args.get("page")) + requested_page = safe_int(request.args.get("page")) # TODO: After security scanner is off, return 400 if not an int selected_techs = request.args.get("selected") selected_rows = str(safe_int(request.args.get("rows"), default=10)) From be383546032c9a4a4ba8f433859e36614a7ecb26 Mon Sep 17 00:00:00 2001 From: Max Ostapenko <1611259+max-ostapenko@users.noreply.github.com> Date: Mon, 14 Jul 2025 12:44:35 +0200 Subject: [PATCH 6/6] lint --- server/routes.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/server/routes.py b/server/routes.py index be2a0cc9..f89807a4 100644 --- a/server/routes.py +++ b/server/routes.py @@ -99,7 +99,9 @@ def techreportlanding(page_id): requested_geo = request.args.get("geo") or "ALL" requested_rank = request.args.get("rank") or "ALL" requested_category = request.args.get("category") or "CMS" - requested_page = safe_int(request.args.get("page")) # TODO: After security scanner is off, return 400 if not an int + requested_page = safe_int( + request.args.get("page") + ) # TODO: After security scanner is off, return 400 if not an int selected_techs = request.args.get("selected") selected_rows = str(safe_int(request.args.get("rows"), default=10))