Skip to content

fix(verify): move spec parsing inside the try block so relative URLs 400, not 500 #333

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AmirF194 wants to merge 1 commit into
base: main
Choose a base branch
from
+16 −1
Open

fix(verify): move spec parsing inside the try block so relative URLs 400, not 500 #333

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion agentic_security/routes/scan.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,8 +30,8 @@ async def verify(
info: LLMInfo, secrets: InMemorySecrets = Depends(get_in_memory_secrets)
) -> dict[str, int | str | float]:
logger.info("verify: checking LLM spec connectivity")
spec = LLMSpec.from_string(info.spec)
try:
spec = LLMSpec.from_string(info.spec)

@msoedov msoedov Aug 25, 2026

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, it's incorrect error handling for this situation LLMSpec.from_string

@AmirF194 AmirF194 Aug 25, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry for the confusion, want to make sure I address the right thing. Looking again at from_string(): it already wraps any exception, bad input or an internal bug in parse_http_spec alike, into InvalidHTTPSpecError. Moving the call inside the try means that branch now returns a clean 400 with no logger call, where the generic except Exception branch below it does call logger.exception. So a genuine internal bug hiding inside parse_http_spec would now return a quiet 400 instead of the loud 500 it produced before, with no server-side trace either way.

Is that the concern, or did you have something else in mind, maybe the status code itself, or a different split between parse errors and verify() errors? Happy to add the missing log line if that is it, or take a different direction if I am off base.

r = await spec.verify()
except InvalidHTTPSpecError as e:
logger.warning("verify: invalid HTTP spec: %s", e)
Expand Down
15 changes: 15 additions & 0 deletions tests/integration/routes/test_scan.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
from fastapi.testclient import TestClient

from agentic_security.app import app

client = TestClient(app)


def test_verify_relative_url_returns_400_not_500():
"""A relative-URL spec should fail parsing with a clean 400, not an
uncaught 500. See https://github.com/msoedov/agentic_security/issues/149.
"""
spec = "POST /chat HTTP/2\nHost: promptairlines.com\nContent-Type: application/json\n\n{}"
response = client.post("/verify", json={"spec": spec})
assert response.status_code == 400
assert "Failed to parse HTTP spec" in response.json()["detail"]