From b15b7b4ae0f87f06f396663743056e090db18183 Mon Sep 17 00:00:00 2001 From: Chuck <33324927+ChuckBuilds@users.noreply.github.com> Date: Mon, 14 Sep 2026 18:54:53 -0400 Subject: [PATCH] fix(auto-update): dismiss route rejects non-object JSON with 400 A JSON array or scalar body made `.get('alert_id')` raise, returning 500. Co-Authored-By: Claude Opus 5 --- test/test_auto_update.py | 5 +++-- web_interface/blueprints/api_v3/system.py | 4 +++- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/test/test_auto_update.py b/test/test_auto_update.py index c329e94f..8b693f5d 100644 --- a/test/test_auto_update.py +++ b/test/test_auto_update.py @@ -639,9 +639,10 @@ class TestStatusRoutes: data = client.get('/api/v3/system/auto-update').get_json()['data'] assert data == {'alert': 'rolled back', 'alert_id': '7'} - def test_dismiss_needs_an_id(self, api_client): + @pytest.mark.parametrize('body', [{}, [1], 'x', 5]) + def test_dismiss_needs_an_id_in_a_json_object(self, api_client, body): client, _, _ = api_client - assert client.post('/api/v3/system/auto-update/dismiss', json={}).status_code == 400 + assert client.post('/api/v3/system/auto-update/dismiss', json=body).status_code == 400 def test_dismiss(self, api_client, monkeypatch): client, _, _ = api_client diff --git a/web_interface/blueprints/api_v3/system.py b/web_interface/blueprints/api_v3/system.py index f18fe968..bb77e208 100644 --- a/web_interface/blueprints/api_v3/system.py +++ b/web_interface/blueprints/api_v3/system.py @@ -141,7 +141,9 @@ def get_auto_update_status(): def dismiss_auto_update_alert(): """Hide the current automatic-update banner until a new alert replaces it.""" from web_interface import auto_update - alert_id = str((request.get_json(silent=True) or {}).get('alert_id') or '').strip() + payload = request.get_json(silent=True) + # A JSON array or scalar is a bad request, not a 500. + alert_id = str(payload.get('alert_id') or '').strip() if isinstance(payload, dict) else '' if not alert_id: return jsonify({'status': 'error', 'message': 'alert_id required'}), 400 auto_update.dismiss_alert(alert_id)