From e52ff305941f138013ed71ba019ae8c14183d3c2 Mon Sep 17 00:00:00 2001 From: Amir Fathi Date: Tue, 25 Aug 2026 07:51:14 +0000 Subject: [PATCH] fix(verify): move spec parsing inside the try block so relative URLs 400, not 500 Fixes #149 --- agentic_security/routes/scan.py | 2 +- tests/integration/routes/test_scan.py | 15 +++++++++++++++ 2 files changed, 16 insertions(+), 1 deletion(-) create mode 100644 tests/integration/routes/test_scan.py diff --git a/agentic_security/routes/scan.py b/agentic_security/routes/scan.py index 319b06a9..f2775f46 100644 --- a/agentic_security/routes/scan.py +++ b/agentic_security/routes/scan.py @@ -30,8 +30,8 @@ async def verify( info: LLMInfo, secrets: InMemorySecrets = Depends(get_in_memory_secrets) ) -> dict[str, int | str | float]: logger.info("verify: checking LLM spec connectivity") - spec = LLMSpec.from_string(info.spec) try: + spec = LLMSpec.from_string(info.spec) r = await spec.verify() except InvalidHTTPSpecError as e: logger.warning("verify: invalid HTTP spec: %s", e) diff --git a/tests/integration/routes/test_scan.py b/tests/integration/routes/test_scan.py new file mode 100644 index 00000000..0600ce9b --- /dev/null +++ b/tests/integration/routes/test_scan.py @@ -0,0 +1,15 @@ +from fastapi.testclient import TestClient + +from agentic_security.app import app + +client = TestClient(app) + + +def test_verify_relative_url_returns_400_not_500(): + """A relative-URL spec should fail parsing with a clean 400, not an + uncaught 500. See https://github.com/msoedov/agentic_security/issues/149. + """ + spec = "POST /chat HTTP/2\nHost: promptairlines.com\nContent-Type: application/json\n\n{}" + response = client.post("/verify", json={"spec": spec}) + assert response.status_code == 400 + assert "Failed to parse HTTP spec" in response.json()["detail"]