#2627·DocsGPT

[BUG] Bug Report: Missing request body validation and uninformative 400 response in POST /api/user/attachments/tts

Author: ayushkujhaCreated Jul 30, 2026Updated Aug 6, 2026

Description

In application/api/user/attachments/routes.py, the POST /api/user/attachments/tts endpoint directly accesses data["text"] without checking if request.get_json() returned None or if the "text" key exists:

python
data = request.get_json()
text = data["text"]


###  Reproduction steps

```text
1. Send a `POST` request to `/api/user/attachments/tts` with header `Content-Type: application/json` and an empty JSON payload `{}`.
2. Observe response status code `400` with body:

   ```json
   {
     "success": false
   }


###  Expected behavior

```text
The endpoint should validate incoming JSON input gracefully using `request.get_json(silent=True) or {}`. If the `text` field is missing, empty, or not a string, it should return a clear `400 Bad Request` response with an explicit message (consistent with other attachment routes):
```json
{
  "success": false,
  "message": "Field 'text' must be a non-empty string"
}

###  Actual Behavior with Screenshots

```text
Currently returns `{"success": false}` with status code 400 and logs an unhandled stack trace in the backend without giving the caller any error message.

Request: POST /api/user/attachments/tts
Payload: {} (empty JSON)

Response Status: 400 Bad Request
Response Body:
{
  "success": false
}

Server Log Output:
KeyError: 'text'
(in application/api/user/attachments/routes.py)


###  Operating system

Windows

### What browsers are you seeing the problem on?

Chrome

###  What development environment are you experiencing this bug on?

Local dev server

###  Did you set the correct environment variables in the right path? List the environment variable names (not values please!)

_No response_

###  Provide any additional context for the Bug.

Proposed fix:
In `application/api/user/attachments/routes.py`:
- Use `data = request.get_json(silent=True) or {}`
- Add explicit validation for `text` (ensure it is a non-empty string).
- Return a 400 response with `{"success": False, "message": "..."}` for invalid payloads.
- Update unit tests in `tests/api/user/attachments/test_routes.py` to cover empty and missing payload edge cases.


###  Relevant log output

```shell
TypeError: 'NoneType' object is not subscriptable
KeyError: 'text'

Have you spent some time to check if this bug has been raised before?

  • I checked and didn't find similar issue

Are you willing to submit PR?

Yes, I am willing to submit a PR!

‍⚖️ Code of Conduct

  • I agree to follow this project's Code of Conduct