fix(image-backends): reject inline base64 that does not decode to PNG, JPEG or WebP by drakeo338 · Pull Request #2927 · ArcReel/ArcReel

drakeo338 · 2026-10-01T16:33:44Z

Closes #2924.

变更

A relay that returns a bare status word such as SUCCESS in the image_b64 field passes base64 decoding, so the garbage bytes were saved as the image and the endpoint test reported a byte count. decode_image_b64 now checks the decoded head for PNG, JPEG or WebP and raises ValueError otherwise, the same as invalid base64.

验证

Ran the declarative image backend and endpoint test preview tests on the committed HEAD: 51 passed, 0 failed (4 of the new tests fail on the parent).
Pinned pre-commit hooks ruff-check and ruff-format passed.
Not run: the full suite.

风险与遗留

无

Summary by CodeRabbit

错误修复
- 无效图片内容不再被误认为有效图像；使用此类内容时，生成会失败且不会创建输出文件。
- 预览报告会将无法识别为有效图像的内容标记为无可用图像数据。
- 支持通过 Base64 或对应的 Data URI 处理 JPEG 和 WebP 图片。

…, JPEG or WebP A relay returning a bare status word such as SUCCESS in the image_b64 field decoded as valid base64, so the garbage bytes were written as the image and the endpoint test reported a byte count. Check the decoded head against the PNG/JPEG/WebP magic numbers and fail the same way an invalid base64 string does.

gemini-code-assist · 2026-10-01T16:33:48Z

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

chatgpt-codex-connector · 2026-10-01T16:33:49Z

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

coderabbitai · 2026-10-01T16:34:16Z

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

🧰 Additional context used

📚 Code guidelines (1)

docs/standards/general.md — configured

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Advanced

Run ID: e6bc48b5-5b3a-4f46-967d-4296f316ec42

📥 Commits

Reviewing files that changed from the base of the PR and between d28c065 and 771e016.

📒 Files selected for processing (3)

lib/custom_provider/declarative_image_backend.py
tests/unit/lib/custom_provider/test_declarative_image_backend.py
tests/unit/lib/custom_provider/test_endpoint_test_preview.py

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (4)

GitHub Check: Analyze (python)
GitHub Check: Backend tests (integration)
GitHub Check: Backend tests (unit)
GitHub Check: postgres-compat

🧰 Additional context used

📓 Path-based instructions (1)

Source excerpt: lint、类型检查、依赖检查报错时修改代码，不加 baseline、计数阈值或整条规则关闭。豁免只用于确认过的误报，每一处都写明理由，理由与豁免写在同一行。 Source excerpt: 行内语法不可用时，豁免写在配置条目旁，每个条目旁用一行注释写明理由： Source excerpt: deptry 的 `DEP002` / `DEP004`：写在 `[tool.deptry.per_rule_ignores]`，按包名逐项列出。 Sour...

📄 CodeRabbit inference engine (docs/standards/general.md)

Files:

tests/unit/lib/custom_provider/test_endpoint_test_preview.py
lib/custom_provider/declarative_image_backend.py
tests/unit/lib/custom_provider/test_declarative_image_backend.py

📝 Walkthrough

Walkthrough

decode_image_b64 现在会检查解码结果是否为 PNG、JPEG 或 WebP。新增测试覆盖非图片内容的生成与预览处理，以及 JPEG、WebP 输入的落盘。

Changes

图片 Base64 校验

Layer / File(s)	Summary
解码结果容器校验 `lib/custom_provider/declarative_image_backend.py`	导入容器嗅探函数，并将 PNG、JPEG 和 WebP 设为允许的容器。`decode_image_b64` 对其他容器抛出 `ValueError`，文档同步列出该失败条件。
生成与响应预览测试 `tests/unit/lib/custom_provider/test_declarative_image_backend.py`, `tests/unit/lib/custom_provider/test_endpoint_test_preview.py`	测试可解码但不是图片的 Base64 内容会导致生成报错且不写入输出文件，并使预览中的 `image_bytes` 为 `None`。测试还覆盖 JPEG、WebP 原始 Base64 和 MIME data URI 的落盘。

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to 771e0

The change rejects non-image Base64 content while preserving PNG, JPEG, and WebP inputs and existing failure reporting. No merge-blocking issue is identified from the supplied evidence; merge after normal checks pass.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 14.29% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 3 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	标题准确概括了主要变更：拒绝无法识别为 PNG、JPEG 或 WebP 的内联 Base64 内容。标题简洁、具体，并符合 Conventional Commit 格式。
Description check	✅ Passed	描述包含关联 issue、变更、验证、风险与遗留四个必需部分。描述说明了问题、实现方式、测试结果和未运行完整测试套件的情况。内容完整且与变更一致。
Linked Issues check	✅ Passed	PR 的代码修改符合直接关联 issue [`#2924`]。`decode_image_b64` 在 Base64 解码后使用 `lib/backends/container_sniff`，只接受 PNG、JPEG 和 WebP。其他可解码内容会被拒绝。生成测试验证此类值返回 `declarative_response_extract_failed`，且不创建输出文件。验证响应测试验证报告中的 `i…
Out of Scope Changes check	✅ Passed	修改范围限于声明式 `image_b64` 的图片格式校验及其生成、验证响应测试。变更直接支持 issue [`#2924`] 的失败处理和 PNG、JPEG、WebP 兼容性要求。摘要未显示对 `image_url` 或其他无关功能的修改。

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

codecov · 2026-10-01T16:36:34Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

drakeo338 requested a review from Pollo3470 as a code owner October 1, 2026 16:33

Pollo3470 merged commit 774d2d3 into ArcReel:main Oct 2, 2026
26 checks passed

arcreel-release-please Bot mentioned this pull request Oct 2, 2026

chore(main): release 0.33.0 #2957

Merged

Navigation Menu

Repository navigation

fix(image-backends): reject inline base64 that does not decode to PNG, JPEG or WebP - #2927

fix(image-backends): reject inline base64 that does not decode to PNG, JPEG or WebP#2927
Pollo3470 merged 1 commit into
ArcReel:mainfrom
drakeo338:claude/2924-fix

drakeo338 commented Oct 1, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

gemini-code-assist Bot commented Oct 1, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 1, 2026

Uh oh!

coderabbitai Bot commented Oct 1, 2026 •

edited

Loading

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

codecov Bot commented Oct 1, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

drakeo338 commented Oct 1, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

变更

验证

风险与遗留

Summary by CodeRabbit

Uh oh!

gemini-code-assist Bot commented Oct 1, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 1, 2026

Uh oh!

coderabbitai Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

codecov Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

drakeo338 commented Oct 1, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 1, 2026 •

edited

Loading

codecov Bot commented Oct 1, 2026 •

edited

Loading