mirror of
https://github.com/yogeshojha/rengine.git
synced 2026-10-20 23:31:31 +02:00
Yogesh OjhaandClaude Opus 5
7460e4a1f4
A 2KB body nested a thousand deep returned 500. The request was correctly rejected — the traceback ends in RequestValidationError — but FastAPI then blew the stack building the 422 itself: its default error puts the offending value in `input`, and jsonable_encoder walks that value recursively. Every depth from about 990 up failed this way, until the JSON parser's own limit took over around twenty thousand and returned a clean 400. Errors are now reported as type, loc and msg, which is the shape FastAPI documents in HTTPValidationError and the only part the frontend reads. Dropping `input` removes the recursion and stops the API reflecting submitted values back in error bodies. Verified: depths 100 through 5000 all answer 422, messages and the loc path including its array index are unchanged, and a sweep of every write endpoint shows the same status distribution as before. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01K6LcH8uUddjJbKrahf34ys
102 lines
2.8 KiB
Python
102 lines
2.8 KiB
Python
from contextlib import asynccontextmanager
|
|
|
|
from fastapi import FastAPI
|
|
from fastapi.exceptions import RequestValidationError
|
|
from fastapi.middleware.cors import CORSMiddleware
|
|
from fastapi.openapi.utils import get_openapi
|
|
from fastapi_pagination import add_pagination
|
|
from sqlalchemy.exc import DBAPIError
|
|
|
|
from app.api.router import router as api_router
|
|
from app.config import settings
|
|
from app.core.db_errors import data_exception_handler
|
|
from app.core.redis_sse_bridge import RedisSSEBridge
|
|
from app.core.sanitize import RejectNulMiddleware
|
|
from app.core.throttle import GlobalRateLimitMiddleware
|
|
from app.core.validation_errors import validation_error_handler
|
|
from app.utils.helpers import create_initial_admin
|
|
from shared.logging import get_logger
|
|
|
|
logger = get_logger(__name__)
|
|
redis_sse_bridge = RedisSSEBridge(settings.redis_url)
|
|
|
|
|
|
@asynccontextmanager
|
|
async def lifespan(_app: FastAPI):
|
|
logger.info("Starting Backend...")
|
|
try:
|
|
await create_initial_admin()
|
|
await redis_sse_bridge.start()
|
|
except Exception as e:
|
|
logger.exception("Failed to initialize the application: %s", e)
|
|
raise e
|
|
yield
|
|
logger.info("Shutting down reNgine Backend...")
|
|
await redis_sse_bridge.stop()
|
|
|
|
|
|
app = FastAPI(
|
|
title=settings.APP_NAME,
|
|
version=settings.APP_VERSION,
|
|
lifespan=lifespan,
|
|
)
|
|
|
|
|
|
add_pagination(app)
|
|
|
|
|
|
def custom_openapi():
|
|
if app.openapi_schema:
|
|
return app.openapi_schema
|
|
|
|
openapi_schema = get_openapi(
|
|
title=settings.APP_NAME,
|
|
version=settings.APP_VERSION,
|
|
description="reNgine 3.0 - Attack Surface Management Platform",
|
|
routes=app.routes,
|
|
)
|
|
|
|
openapi_schema["components"]["securitySchemes"] = {
|
|
"BearerAuth": {
|
|
"type": "http",
|
|
"scheme": "bearer",
|
|
"bearerFormat": "JWT",
|
|
"description": "Enter your JWT token from /auth/login",
|
|
}
|
|
}
|
|
|
|
app.openapi_schema = openapi_schema
|
|
return app.openapi_schema
|
|
|
|
|
|
app.openapi = custom_openapi
|
|
|
|
if "*" in settings.CORS_ORIGINS:
|
|
msg = "CORS_ORIGINS must be an explicit allowlist (no '*') when credentials are enabled"
|
|
raise ValueError(msg)
|
|
|
|
app.add_exception_handler(DBAPIError, data_exception_handler)
|
|
app.add_exception_handler(RequestValidationError, validation_error_handler)
|
|
|
|
app.add_middleware(GlobalRateLimitMiddleware)
|
|
app.add_middleware(RejectNulMiddleware)
|
|
app.add_middleware(
|
|
CORSMiddleware,
|
|
allow_origins=settings.CORS_ORIGINS,
|
|
allow_credentials=True,
|
|
allow_methods=["*"],
|
|
allow_headers=["*"],
|
|
)
|
|
|
|
app.include_router(api_router, prefix=settings.API_V1_PREFIX)
|
|
|
|
|
|
@app.get("/")
|
|
async def root():
|
|
logger.debug("Root endpoint accessed")
|
|
return {
|
|
"message": "Welcome to reNgine API",
|
|
"version": settings.APP_VERSION,
|
|
"docs": "/docs",
|
|
}
|