Skip to content

fix: harden input validation, file safety, and error handling #227

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ankit1999 wants to merge 11 commits into
base: main
Choose a base branch
from
Open

fix: harden input validation, file safety, and error handling #227

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
9c97815
feat: add custom HuggingFace voice model support
ankit1999 Mar 1, 2026
a7e698a
fix: harden input validation, file safety, and error handling
ankit1999 Mar 2, 2026
888d5a5
fix(review): address second round of code review feedback
ankit1999 Apr 19, 2026
10446f1
fix(review): address third round of code review feedback
ankit1999 Apr 19, 2026
d983119
fix(review): address fourth round of code review feedback
ankit1999 Apr 19, 2026
4447a87
fix(review): address fifth round of code review feedback
ankit1999 Apr 19, 2026
ff9c08d
Merge origin/main into feat/custom-voice-models
ankit1999 Apr 19, 2026
ae135ae
chore: remove workflow files (will be added separately with workflow …
ankit1999 Apr 19, 2026
b7c1200
fix(review): address CodeRabbit feedback on routes/models.py
ankit1999 Apr 20, 2026
f338e35
Merge origin/main (catch up with upstream fixes)
ankit1999 Apr 20, 2026
c49aec4
fix: resolve PR #225 compilation issues in ModelManagement.tsx
ankit1999 Apr 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 39 additions & 7 deletions app/src/components/Generation/FloatingGenerateBox.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,14 +7,17 @@ import { Form, FormControl, FormField, FormItem, FormMessage } from '@/component
import {
Select,
SelectContent,
SelectGroup,
SelectItem,
SelectLabel,
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated
SelectTrigger,
SelectValue,
} from '@/components/ui/select';
import { Textarea } from '@/components/ui/textarea';
import { useToast } from '@/components/ui/use-toast';
import { LANGUAGE_OPTIONS } from '@/lib/constants/languages';
import { useGenerationForm } from '@/lib/hooks/useGenerationForm';
import { useModelStatus } from '@/lib/hooks/useModelStatus';
import { useProfile, useProfiles } from '@/lib/hooks/useProfiles';
import { useAddStoryItem, useStory } from '@/lib/hooks/useStories';
import { cn } from '@/lib/utils/cn';
Expand Down Expand Up @@ -46,6 +49,9 @@ export function FloatingGenerateBox({
const addStoryItem = useAddStoryItem();
const { toast } = useToast();

// Use shared hook for model status fetching and grouping
const { builtInModels, customModels } = useModelStatus();

// Calculate if track editor is visible (on stories route with items)
const hasTrackEditor = isStoriesRoute && currentStory && currentStory.items.length > 0;

Expand Down Expand Up @@ -173,7 +179,7 @@ export function FloatingGenerateBox({
'fixed right-auto',
isStoriesRoute
? // Position aligned with story list: after sidebar + padding, width 360px
'left-[calc(5rem+2rem)] w-[360px]'
'left-[calc(5rem+2rem)] w-[360px]'
: 'left-[calc(5rem+2rem)] w-[calc((100%-5rem-4rem)/2-1rem)]',
)}
style={{
Expand Down Expand Up @@ -414,12 +420,38 @@ export function FloatingGenerateBox({
</SelectTrigger>
</FormControl>
<SelectContent>
<SelectItem value="1.7B" className="text-xs text-muted-foreground">
Qwen3-TTS 1.7B
</SelectItem>
<SelectItem value="0.6B" className="text-xs text-muted-foreground">
Qwen3-TTS 0.6B
</SelectItem>
<SelectGroup>
<SelectLabel className="text-xs">Built-in</SelectLabel>
{builtInModels.length > 0 ? (
builtInModels.map((model) => {
const sizeValue = model.model_name.replace('qwen-tts-', '');
return (
<SelectItem key={model.model_name} value={sizeValue} className="text-xs text-muted-foreground">
{model.display_name}
</SelectItem>
);
})
) : (
<>
<SelectItem value="1.7B" className="text-xs text-muted-foreground">
Qwen3-TTS 1.7B
</SelectItem>
<SelectItem value="0.6B" className="text-xs text-muted-foreground">
Qwen3-TTS 0.6B
</SelectItem>
</>
)}
</SelectGroup>
{customModels.length > 0 && (
<SelectGroup>
<SelectLabel className="text-xs">Custom</SelectLabel>
{customModels.map((model) => (
<SelectItem key={model.model_name} value={model.model_name} className="text-xs text-muted-foreground">
{model.display_name}
</SelectItem>
))}
</SelectGroup>
)}
</SelectContent>
</Select>
<FormMessage className="text-xs" />
Expand Down
41 changes: 37 additions & 4 deletions app/src/components/Generation/GenerationForm.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,13 +14,16 @@ import { Input } from '@/components/ui/input';
import {
Select,
SelectContent,
SelectGroup,
SelectItem,
SelectLabel,
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated
SelectTrigger,
SelectValue,
} from '@/components/ui/select';
import { Textarea } from '@/components/ui/textarea';
import { LANGUAGE_OPTIONS } from '@/lib/constants/languages';
import { useGenerationForm } from '@/lib/hooks/useGenerationForm';
import { useModelStatus } from '@/lib/hooks/useModelStatus';
import { useProfile } from '@/lib/hooks/useProfiles';
import { useUIStore } from '@/stores/uiStore';

Expand All @@ -30,6 +33,9 @@ export function GenerationForm() {

const { form, handleSubmit, isPending } = useGenerationForm();

// Use shared hook for model status fetching and grouping
const { builtInModels, customModels } = useModelStatus();
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Prevent built-in/custom option overlap from hook classification.

builtInModels from useModelStatus is based on model_name.startsWith('qwen-tts'). A custom repo like qwen-tts/my-voice can appear in both groups and be misinterpreted in built-in mapping.

🔧 Proposed fix (in app/src/lib/hooks/useModelStatus.ts) 
-const builtInModels =
-  modelStatus?.models.filter((m) => m.model_name.startsWith('qwen-tts')) || [];
+const builtInModels =
+  modelStatus?.models.filter((m) => !m.is_custom && m.model_name.startsWith('qwen-tts-')) || [];
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@app/src/components/Generation/GenerationForm.tsx` at line 37, The hook
useModelStatus currently classifies builtInModels using
model_name.startsWith('qwen-tts'), which incorrectly flags repos like
"qwen-tts/my-voice" as built-in; update the predicate in useModelStatus (the
filter that builds builtInModels/customModels) to only treat true built-ins such
as the core qwen-tts identifier (e.g., model_name === 'qwen-tts' or match a
pattern that disallows a following '/'), for example replace
startsWith('qwen-tts') with a stricter check (exact equality or a regex like
/^qwen-tts($|[:@])/) so repo-qualified names with a slash go to customModels.


async function onSubmit(data: Parameters<typeof handleSubmit>[0]) {
await handleSubmit(data, selectedProfileId);
}
Expand Down Expand Up @@ -129,19 +135,46 @@ export function GenerationForm() {
name="modelSize"
render={({ field }) => (
<FormItem>
<FormLabel>Model Size</FormLabel>
<FormLabel>Model</FormLabel>
<Select onValueChange={field.onChange} defaultValue={field.value}>
<FormControl>
<SelectTrigger>
<SelectValue />
</SelectTrigger>
</FormControl>
<SelectContent>
<SelectItem value="1.7B">Qwen TTS 1.7B (Higher Quality)</SelectItem>
<SelectItem value="0.6B">Qwen TTS 0.6B (Faster)</SelectItem>
<SelectGroup>
<SelectLabel>Built-in</SelectLabel>
{builtInModels.length > 0 ? (
builtInModels.map((model) => {
// Map model_name (qwen-tts-1.7B) back to model_size value (1.7B)
const sizeValue = model.model_name.replace('qwen-tts-', '');
return (
<SelectItem key={model.model_name} value={sizeValue}>
{model.display_name}
</SelectItem>
);
})
) : (
<>
<SelectItem value="1.7B">Qwen TTS 1.7B (Higher Quality)</SelectItem>
<SelectItem value="0.6B">Qwen TTS 0.6B (Faster)</SelectItem>
</>
)}
</SelectGroup>
{customModels.length > 0 && (
<SelectGroup>
<SelectLabel>Custom</SelectLabel>
{customModels.map((model) => (
<SelectItem key={model.model_name} value={model.model_name}>
{model.display_name}
</SelectItem>
))}
</SelectGroup>
)}
</SelectContent>
</Select>
<FormDescription>Larger models produce better quality</FormDescription>
<FormDescription>Select voice generation model</FormDescription>
<FormMessage />
</FormItem>
)}
Expand Down
Loading