PG1204 opened a new issue, #8869:
URL: https://github.com/apache/texera/issues/8869

   ### What happened?
   
   `AudioTaskCodegen.parsePython` reads a provider's response without checking 
the types it finds, so a malformed but valid-JSON 200 produces a broken or 
non-string value in the result column rather than degrading to the raw body. 
Verified against the generated parser:
   
   | Response body | Result column gets |
   |---|---|
   | `{"audio": {"b64_json": null}}` | `data:audio/mpeg;base64,None` |
   | `{"audio": {"b64_json": 42}}` | `data:audio/mpeg;base64,42` |
   | `{"audio": {"b64_json": "not base64!"}}` | `data:audio/mpeg;base64,not 
base64!` |
   | `{"audio": {"url": 42}}` | `_url_to_data_url` called with an int |
   | `{"audio": {"url": null}}` | `_url_to_data_url` called with None |
   | `{"data": {"a": 1}}` | raises `KeyError: 0` |
   | `{"text": 42}` (ASR) | the number `42`, not a string |
   | `{"generated_text": null}` (ASR) | Python `None` |
   
   Four distinct gaps:
   
   1. **`b64_json` is spliced into a data URL unvalidated**, at both sites 
(lines 60-61 and 67-68). The cell then holds a `data:` URL that no audio 
element can play, with nothing indicating why.
   2. **`url` is passed to `_url_to_data_url` unvalidated**, at lines 58-59 and 
65-66, note the inconsistency, since the `output` branch just above *does* 
guard with `isinstance(url, str) and url.startswith("http")`. A non-string 
reaches `_fetch_remote_url` and `urlparse`.
   3. **`data[0]` is indexed without checking `data` is a list** (line 64). A 
dict body raises `KeyError`, which `_parse_response` catches, so it degrades by 
exception rather than cleanly.
   4. **`text` and `generated_text` are returned unvalidated** 
(automatic-speech-recognition), so a non-string value is written to the result 
column as-is. This is the same defect #8486 fixed for chat content, in a 
codegen that was out of that PR's scope.
   
   None of these abort the run and `_parse_response` catches 
`KeyError`/`IndexError`/`TypeError` and the row loop catches the rest per row,  
but the row ends up with a corrupt or non-string value instead of the body it 
was given.
   
   ### How to reproduce?
   
   Run the operator with `text-to-speech` (or `automatic-speech-recognition`) 
against a provider that returns a 200 whose `b64_json`, `url`, or `text` is 
null, numeric, or otherwise not the expected type. The result column receives 
the malformed value rather than the serialized body.
   
   ### Version/Branch
   
   1.4.0-incubating-SNAPSHOT (main)
   
   ### Commit Hash (Optional)
   
   _No response_
   
   ### What browsers are you seeing the problem on?
   
   _No response_
   
   ### Relevant log output
   
   ```shell
   
   ```


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to