Skip to content

Improve JSON handling and HTML encoding in API helpers#4489

Merged
ravirk91 merged 2 commits into
masterfrom
code_enhancement_security
Apr 29, 2026
Merged

Improve JSON handling and HTML encoding in API helpers#4489
ravirk91 merged 2 commits into
masterfrom
code_enhancement_security

Conversation

@tanushahande2003

@tanushahande2003 tanushahande2003 commented Apr 29, 2026

Copy link
Copy Markdown
Contributor

Refactored WireMockAPI to use System.Text.Json for payload serialization and robust JSON parsing for stub mappings. Enhanced GenAIServiceHelper to HTML-encode error logs and multipart form data, ensuring safer handling of special characters and null values.

Description

Type of Change

  • Bug fix - [ ] New feature - [ ] Breaking change - [ ] Plugin update

Checklist

  • PR description clearly describes the changes
  • Target branch is correct (master for features, Releases/* for fixes)
  • Latest code from target branch merged
  • No commented/junk code included
  • No new build warnings or errors
  • All existing unit tests pass
  • New unit tests added for new functionality
  • Cross-platform compatibility verified (Windows/Linux/macOS)
  • CI/CD pipeline passes
  • Code follows project conventions (Act{Platform}{Type}, {Platform}Driver)
  • Repository objects use [IsSerializedForLocalRepository] where needed
  • Error handling uses Reporter.ToLog() pattern
  • Documentation updated for user-facing changes
  • Self-review completed and code review comments addressed

Summary by CodeRabbit

  • Improvements
    • Enhanced JSON handling in API operations with improved serialization and parsing for request body construction during recording and stub management.
  • Security
    • Implemented HTML-encoding for sensitive credential values, error messages, and stack traces before logging and external submission.

Refactored WireMockAPI to use System.Text.Json for payload serialization and robust JSON parsing for stub mappings. Enhanced GenAIServiceHelper to HTML-encode error logs and multipart form data, ensuring safer handling of special characters and null values.
@coderabbitai

coderabbitai Bot commented Apr 29, 2026

Copy link
Copy Markdown
Contributor

Warning

Rate limit exceeded

@tanushahande2003 has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 33 minutes and 40 seconds before requesting another review.

To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 067c3af8-6ed7-4cb0-9496-1fd944d4968b

📥 Commits

Reviewing files that changed from the base of the PR and between 4ec4e8d and edd660d.

📒 Files selected for processing (1)
  • Ginger/GingerCoreNET/GenAIServices/GenAIServiceHelper.cs

Walkthrough

Two utility classes receive targeted updates: WireMockAPI.cs now uses JsonSerializer.Serialize and JsonDocument parsing for structured JSON request body construction in recording and stub operations; GenAIServiceHelper.cs adds HTML encoding of sensitive credential values before logging and multipart form submission.

Changes

Cohort / File(s) Summary
WireMockAPI JSON Handling
Ginger/GingerCoreNET/External/WireMock/WireMockAPI.cs
Recording now uses JsonSerializer.Serialize instead of string interpolation. Stub creation/update operations parse stubMapping with JsonDocument and extract raw JSON text rather than sending the object directly, while preserving null/empty inputs and maintaining content-type headers.
GenAIServiceHelper Encoding
Ginger/GingerCoreNET/GenAIServices/GenAIServiceHelper.cs
Exception details (Message, InnerException, StackTrace) are HTML-encoded before logging in GetToken. Credential values (account, domainType, temperatureVal, maxTokensVal, dataPath) are HTML-encoded before use in PrepareRequestDetailsForChat multipart parameters, with null results defaulting to empty strings.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

  • Fix for unwanted popup msgs #4123: Modifies the same WireMockAPI methods (StartRecordingAsync, CreateStubAsync, UpdateStubAsync) with overlapping changes to JSON handling patterns.

Suggested reviewers

  • ravirk91
  • IamRanjeetSingh
  • MeniKadosh1

Poem

🐰 The JSON now flows through serialize's care,
While HTML encoding shields secrets so fair,
No more string interpolation's rough hand,
Just structured, safe data—carefully planned! 🎀

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 60.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title accurately summarizes the main changes: JSON handling improvements in WireMockAPI and HTML encoding enhancements in GenAIServiceHelper, matching the core objectives.
Description check ✅ Passed The description provides a clear overview of changes and includes the required template structure, though most checklist items remain unchecked without explicit confirmation.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch code_enhancement_security

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share
Review rate limit: 0/1 reviews remaining, refill in 33 minutes and 40 seconds.

Comment @coderabbitai help to get the list of available commands and usage tips.

@codacy-production

codacy-production Bot commented Apr 29, 2026

Copy link
Copy Markdown

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 5 complexity

Metric Results
Complexity 5

View in Codacy

NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 5

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@Ginger/GingerCoreNET/External/WireMock/WireMockAPI.cs`:
- Around line 159-168: Extract the duplicated JSON normalization into a single
private helper (e.g., NormalizeStubMappingBody) and replace the parse/normalize
blocks inside CreateStubAsync and UpdateStubAsync with calls to that helper; the
helper should return string.Empty for null/empty input and otherwise parse with
JsonDocument and return doc.RootElement.GetRawText(), ensuring both
CreateStubAsync and UpdateStubAsync use it to avoid duplication and future
drift.
- Around line 103-104: Add a fail-fast guard in the WireMockAPI routine that
posts the recording config: check the targetUrl parameter (the variable named
targetUrl used when building the JSON and StringContent) for null or whitespace
before calling JsonSerializer.Serialize or issuing the HTTP request; if invalid,
log an error via the existing logger and return early (or throw a descriptive
ArgumentException) instead of proceeding to create content and post, so the
validation failure is handled locally in the method that constructs the
recording config.
- Around line 160-170: The null handling for stubMapping is incorrect: when
stubMapping is null you assign body = null which causes new StringContent(body,
...) to throw; in the methods that contain this logic (the WireMockAPI class
methods that build the request body—e.g., CreateStubAsync and UpdateStubAsync)
add an explicit null check for stubMapping and return early (or throw a clear,
documented exception) before constructing StringContent, and keep the
empty-string case separate (if stubMapping == "" set body = "" else parse JSON
into body via JsonDocument.Parse). Ensure you reference the stubMapping -> body
-> new StringContent(...) flow and apply the same fix in both affected blocks.

In `@Ginger/GingerCoreNET/GenAIServices/GenAIServiceHelper.cs`:
- Around line 108-109: The two duplicate Reporter.ToLog calls in
GenAIServiceHelper.cs (the ones using WebUtility.HtmlEncode on
ex.Message/InnerException/StackTrace) should be consolidated into a single call
that passes the exception object directly to Reporter.ToLog (following the
established pattern), removing the HTML-encoding and the explicit
stack-trace/inner-exception string logging; locate the Reporter.ToLog
invocations in the method where 'ex' is caught and replace them with a single
Reporter.ToLog(eLogLevel.ERROR, error, ex) (or equivalent overload) so log4net
handles formatting/encoding and no sensitive stack text is output manually.
- Around line 249-253: The multipart form fields are being HTML-encoded which
corrupts their values; remove WebUtility.HtmlEncode when creating StringContent
for the AskLisaConfiguration fields so they are sent raw like the "question"
field. Replace occurrences that wrap
CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.Account/DomainType/TemperatureLevel/MaxTokenValue/DataPath)
with simple StringContent(CredentialsCalculation(...) ?? string.Empty)
(preserving the same field names
"account","domainType","temperatureVal","maxTokensVal","dataPath") so the
multipart form data is not HTML-encoded.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 087e22a8-a2d2-4ef2-b82a-eefc96cdd8e8

📥 Commits

Reviewing files that changed from the base of the PR and between bccf642 and 4ec4e8d.

📒 Files selected for processing (2)
  • Ginger/GingerCoreNET/External/WireMock/WireMockAPI.cs
  • Ginger/GingerCoreNET/GenAIServices/GenAIServiceHelper.cs

Comment on lines +103 to +104
string json = JsonSerializer.Serialize(new { targetBaseUrl = targetUrl });
var content = new StringContent(json, Encoding.UTF8, "application/json");

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Add a fail-fast guard for targetUrl before posting recording config.

Line 103 will serialize null/whitespace values and still issue the HTTP request, pushing validation failure downstream into a generic catch path. Validate input up front and return early with an error log.

Suggested patch
 public async Task<string> StartRecordingAsync(string targetUrl)
 {
     try
     {
         if (string.IsNullOrEmpty(_baseUrl))
         {
             return string.Empty;
         }
+        if (string.IsNullOrWhiteSpace(targetUrl))
+        {
+            Reporter.ToLog(eLogLevel.ERROR, "Target URL cannot be empty when starting WireMock recording");
+            return string.Empty;
+        }

         using (HttpClient client = new HttpClient())
         {
             string json = JsonSerializer.Serialize(new { targetBaseUrl = targetUrl });
             var content = new StringContent(json, Encoding.UTF8, "application/json");
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@Ginger/GingerCoreNET/External/WireMock/WireMockAPI.cs` around lines 103 -
104, Add a fail-fast guard in the WireMockAPI routine that posts the recording
config: check the targetUrl parameter (the variable named targetUrl used when
building the JSON and StringContent) for null or whitespace before calling
JsonSerializer.Serialize or issuing the HTTP request; if invalid, log an error
via the existing logger and return early (or throw a descriptive
ArgumentException) instead of proceeding to create content and post, so the
validation failure is handled locally in the method that constructs the
recording config.

Comment on lines +159 to +168
string body;
if (string.IsNullOrEmpty(stubMapping))
{
body = stubMapping;
}
else
{
using JsonDocument doc = JsonDocument.Parse(stubMapping);
body = doc.RootElement.GetRawText();
}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick | 🔵 Trivial

Extract JSON-body normalization into a shared helper.

The same parse/normalize block is duplicated in CreateStubAsync and UpdateStubAsync. Centralizing this logic will prevent drift and simplify future validation changes.

Refactor direction
-                    string body;
-                    if (string.IsNullOrEmpty(stubMapping))
-                    {
-                        body = stubMapping;
-                    }
-                    else
-                    {
-                        using JsonDocument doc = JsonDocument.Parse(stubMapping);
-                        body = doc.RootElement.GetRawText();
-                    }
+                    string body = NormalizeStubMappingBody(stubMapping);
private static string NormalizeStubMappingBody(string stubMapping)
{
    if (stubMapping is null) return string.Empty;
    if (stubMapping.Length == 0) return string.Empty;

    using JsonDocument doc = JsonDocument.Parse(stubMapping);
    return doc.RootElement.GetRawText();
}

Also applies to: 221-230

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@Ginger/GingerCoreNET/External/WireMock/WireMockAPI.cs` around lines 159 -
168, Extract the duplicated JSON normalization into a single private helper
(e.g., NormalizeStubMappingBody) and replace the parse/normalize blocks inside
CreateStubAsync and UpdateStubAsync with calls to that helper; the helper should
return string.Empty for null/empty input and otherwise parse with JsonDocument
and return doc.RootElement.GetRawText(), ensuring both CreateStubAsync and
UpdateStubAsync use it to avoid duplication and future drift.

Comment on lines +160 to +170
if (string.IsNullOrEmpty(stubMapping))
{
body = stubMapping;
}
else
{
using JsonDocument doc = JsonDocument.Parse(stubMapping);
body = doc.RootElement.GetRawText();
}

var content = new StringContent(body, Encoding.UTF8, contentType);

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

In .NET, does new StringContent((string)null, Encoding.UTF8, "application/json")throwArgumentNullException?

💡 Result:

Yes, new StringContent((string)null, Encoding.UTF8, "application/json") throws an ArgumentNullException.

Citations:


🏁 Script executed:

fd -t f "WireMockAPI.cs" | head -5

Repository: Ginger-Automation/Ginger

Length of output: 122


🏁 Script executed:

fd -t f "WireMockAPI.cs" --exec cat -n {} \; | sed -n '155,240p'

Repository: Ginger-Automation/Ginger

Length of output: 4085


🏁 Script executed:

rg "Reporter\.ToLog\(eLogLevel\.ERROR" -t cs | head -10

Repository: Ginger-Automation/Ginger

Length of output: 1643


Null stubMapping causes ArgumentNullException at StringContent construction.

The code at lines 160–170 and 221–233 contains a logic error: when stubMapping is null, the condition string.IsNullOrEmpty(stubMapping) evaluates to true, and body is assigned the null value. This causes new StringContent(body, ...) to throw ArgumentNullException before the request is sent, making null handling brittle.

Separate the null check from the empty check and return early:

Suggested fix
                    string body;
                    if (stubMapping is null)
                    {
                        Reporter.ToLog(eLogLevel.ERROR, "Stub mapping cannot be null");
                        return string.Empty;
                    }
                    else if (stubMapping.Length == 0)
                    {
                        body = string.Empty;
                    }
                    else
                    {
                        using JsonDocument doc = JsonDocument.Parse(stubMapping);
                        body = doc.RootElement.GetRawText();
                    }

Also applies to lines 221–233 in UpdateStubAsync.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@Ginger/GingerCoreNET/External/WireMock/WireMockAPI.cs` around lines 160 -
170, The null handling for stubMapping is incorrect: when stubMapping is null
you assign body = null which causes new StringContent(body, ...) to throw; in
the methods that contain this logic (the WireMockAPI class methods that build
the request body—e.g., CreateStubAsync and UpdateStubAsync) add an explicit null
check for stubMapping and return early (or throw a clear, documented exception)
before constructing StringContent, and keep the empty-string case separate (if
stubMapping == "" set body = "" else parse JSON into body via
JsonDocument.Parse). Ensure you reference the stubMapping -> body -> new
StringContent(...) flow and apply the same fix in both affected blocks.

Comment thread Ginger/GingerCoreNET/GenAIServices/GenAIServiceHelper.cs Outdated
Comment on lines +249 to +253
{ new StringContent(WebUtility.HtmlEncode(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.Account) ?? string.Empty)), "account" },
{ new StringContent(WebUtility.HtmlEncode(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.DomainType) ?? string.Empty)), "domainType" },
{ new StringContent(WebUtility.HtmlEncode(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.TemperatureLevel) ?? string.Empty)), "temperatureVal" },
{ new StringContent(WebUtility.HtmlEncode(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.MaxTokenValue) ?? string.Empty)), "maxTokensVal" },
{ new StringContent(WebUtility.HtmlEncode(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.DataPath) ?? string.Empty)), "dataPath" }

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

# First, check if the file exists and examine the code at lines 249-253
fd 'GenAIServiceHelper.cs' --type f

Repository: Ginger-Automation/Ginger

Length of output: 125


🏁 Script executed:

# Examine the code at lines 249-253 and surrounding context
cat -n Ginger/GingerCoreNET/GenAIServices/GenAIServiceHelper.cs | sed -n '240,260p'

Repository: Ginger-Automation/Ginger

Length of output: 1445


🏁 Script executed:

# Search for other uses of HtmlEncode in this file and similar patterns
rg -n "HtmlEncode" Ginger/GingerCoreNET/GenAIServices/GenAIServiceHelper.cs

Repository: Ginger-Automation/Ginger

Length of output: 1380


🏁 Script executed:

# Look for how this PrepareRequestDetailsForChat method is used
rg -n "PrepareRequestDetailsForChat" Ginger/GingerCoreNET/GenAIServices/GenAIServiceHelper.cs -A 5 -B 2

Repository: Ginger-Automation/Ginger

Length of output: 1396


🏁 Script executed:

# Check the Question parameter - it's not HTML encoded, let's verify multipart form data best practices
# Also look for similar patterns in the codebase with MultipartFormDataContent
rg -n "MultipartFormDataContent" Ginger/GingerCoreNET/GenAIServices/ -A 10 | head -80

Repository: Ginger-Automation/Ginger

Length of output: 4516


🏁 Script executed:

# Check the complete method signature and context to understand what API endpoint is being called
cat -n Ginger/GingerCoreNET/GenAIServices/GenAIServiceHelper.cs | sed -n '1,20p'

Repository: Ginger-Automation/Ginger

Length of output: 878


🏁 Script executed:

# Check git history or comments to see if there's a reason for HtmlEncode
cat -n Ginger/GingerCoreNET/GenAIServices/GenAIServiceHelper.cs | sed -n '244,256p'

Repository: Ginger-Automation/Ginger

Length of output: 1328


🏁 Script executed:

# Check for any documentation or comments about why HtmlEncode is used
cat -n Ginger/GingerCoreNET/GenAIServices/GenAIServiceHelper.cs | sed -n '155,195p'

Repository: Ginger-Automation/Ginger

Length of output: 1954


🏁 Script executed:

# Check the complete file to understand class structure and imports
wc -l Ginger/GingerCoreNET/GenAIServices/GenAIServiceHelper.cs

Repository: Ginger-Automation/Ginger

Length of output: 129


Remove WebUtility.HtmlEncode() calls from multipart form data fields.

At lines 249-253, HTML encoding corrupts the form field values for an HTTP multipart request. Multipart form data is not HTML content and should not be HTML-encoded; special characters like &, <, > will be converted to entities (&amp;, &lt;, &gt;), breaking the API contract. The "question" field at line 248 is correctly sent unencoded—apply the same approach to all form fields.

Suggested fix
- { new StringContent(WebUtility.HtmlEncode(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.Account) ?? string.Empty)), "account" },
- { new StringContent(WebUtility.HtmlEncode(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.DomainType) ?? string.Empty)), "domainType" },
- { new StringContent(WebUtility.HtmlEncode(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.TemperatureLevel) ?? string.Empty)), "temperatureVal" },
- { new StringContent(WebUtility.HtmlEncode(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.MaxTokenValue) ?? string.Empty)), "maxTokensVal" },
- { new StringContent(WebUtility.HtmlEncode(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.DataPath) ?? string.Empty)), "dataPath" }
+ { new StringContent(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.Account) ?? string.Empty), "account" },
+ { new StringContent(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.DomainType) ?? string.Empty), "domainType" },
+ { new StringContent(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.TemperatureLevel) ?? string.Empty), "temperatureVal" },
+ { new StringContent(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.MaxTokenValue) ?? string.Empty), "maxTokensVal" },
+ { new StringContent(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.DataPath) ?? string.Empty), "dataPath" }
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
{ new StringContent(WebUtility.HtmlEncode(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.Account) ?? string.Empty)), "account" },
{ new StringContent(WebUtility.HtmlEncode(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.DomainType) ?? string.Empty)), "domainType" },
{ new StringContent(WebUtility.HtmlEncode(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.TemperatureLevel) ?? string.Empty)), "temperatureVal" },
{ new StringContent(WebUtility.HtmlEncode(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.MaxTokenValue) ?? string.Empty)), "maxTokensVal" },
{ new StringContent(WebUtility.HtmlEncode(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.DataPath) ?? string.Empty)), "dataPath" }
{ new StringContent(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.Account) ?? string.Empty), "account" },
{ new StringContent(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.DomainType) ?? string.Empty), "domainType" },
{ new StringContent(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.TemperatureLevel) ?? string.Empty), "temperatureVal" },
{ new StringContent(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.MaxTokenValue) ?? string.Empty), "maxTokensVal" },
{ new StringContent(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.DataPath) ?? string.Empty), "dataPath" }
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@Ginger/GingerCoreNET/GenAIServices/GenAIServiceHelper.cs` around lines 249 -
253, The multipart form fields are being HTML-encoded which corrupts their
values; remove WebUtility.HtmlEncode when creating StringContent for the
AskLisaConfiguration fields so they are sent raw like the "question" field.
Replace occurrences that wrap
CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.Account/DomainType/TemperatureLevel/MaxTokenValue/DataPath)
with simple StringContent(CredentialsCalculation(...) ?? string.Empty)
(preserving the same field names
"account","domainType","temperatureVal","maxTokensVal","dataPath") so the
multipart form data is not HTML-encoded.

ravirk91
ravirk91 previously approved these changes Apr 29, 2026
body = doc.RootElement.GetRawText();
}

var content = new StringContent(body, Encoding.UTF8, contentType);
{ new StringContent(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.TemperatureLevel)), "temperatureVal" },
{ new StringContent(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.MaxTokenValue)), "maxTokensVal" },
{ new StringContent(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.DataPath)), "dataPath" }
{ new StringContent(WebUtility.HtmlEncode(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.Account) ?? string.Empty)), "account" },
{ new StringContent(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.MaxTokenValue)), "maxTokensVal" },
{ new StringContent(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.DataPath)), "dataPath" }
{ new StringContent(WebUtility.HtmlEncode(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.Account) ?? string.Empty)), "account" },
{ new StringContent(WebUtility.HtmlEncode(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.DomainType) ?? string.Empty)), "domainType" },
{ new StringContent(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.DataPath)), "dataPath" }
{ new StringContent(WebUtility.HtmlEncode(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.Account) ?? string.Empty)), "account" },
{ new StringContent(WebUtility.HtmlEncode(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.DomainType) ?? string.Empty)), "domainType" },
{ new StringContent(WebUtility.HtmlEncode(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.TemperatureLevel) ?? string.Empty)), "temperatureVal" },
{ new StringContent(WebUtility.HtmlEncode(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.Account) ?? string.Empty)), "account" },
{ new StringContent(WebUtility.HtmlEncode(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.DomainType) ?? string.Empty)), "domainType" },
{ new StringContent(WebUtility.HtmlEncode(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.TemperatureLevel) ?? string.Empty)), "temperatureVal" },
{ new StringContent(WebUtility.HtmlEncode(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.MaxTokenValue) ?? string.Empty)), "maxTokensVal" },
{ new StringContent(WebUtility.HtmlEncode(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.DomainType) ?? string.Empty)), "domainType" },
{ new StringContent(WebUtility.HtmlEncode(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.TemperatureLevel) ?? string.Empty)), "temperatureVal" },
{ new StringContent(WebUtility.HtmlEncode(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.MaxTokenValue) ?? string.Empty)), "maxTokensVal" },
{ new StringContent(WebUtility.HtmlEncode(CredentialsCalculation(WorkSpace.Instance.Solution.AskLisaConfiguration.DataPath) ?? string.Empty)), "dataPath" }
Simplified exception handling by replacing manual error message construction and encoding with a single Reporter.ToLog call that passes the exception object, leveraging built-in logging features.
@ravirk91
ravirk91 merged commit 42a8a28 into master Apr 29, 2026
7 checks passed
@ravirk91
ravirk91 deleted the code_enhancement_security branch April 29, 2026 10:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants