[BUG] Bug Report: Missing request body validation and uninformative 400 response in POST /api/user/attachments/tts
Author: ayushkujhaCreated Jul 30, 2026Updated Aug 6, 2026
Description
In application/api/user/attachments/routes.py, the POST /api/user/attachments/tts endpoint directly accesses data["text"] without checking if request.get_json() returned None or if the "text" key exists:
data = request.get_json()
text = data["text"]
### Reproduction steps
```text
1. Send a `POST` request to `/api/user/attachments/tts` with header `Content-Type: application/json` and an empty JSON payload `{}`.
2. Observe response status code `400` with body:
```json
{
"success": false
}
### Expected behavior
```text
The endpoint should validate incoming JSON input gracefully using `request.get_json(silent=True) or {}`. If the `text` field is missing, empty, or not a string, it should return a clear `400 Bad Request` response with an explicit message (consistent with other attachment routes):
```json
{
"success": false,
"message": "Field 'text' must be a non-empty string"
}
### Actual Behavior with Screenshots
```text
Currently returns `{"success": false}` with status code 400 and logs an unhandled stack trace in the backend without giving the caller any error message.
Request: POST /api/user/attachments/tts
Payload: {} (empty JSON)
Response Status: 400 Bad Request
Response Body:
{
"success": false
}
Server Log Output:
KeyError: 'text'
(in application/api/user/attachments/routes.py)
### Operating system
Windows
### What browsers are you seeing the problem on?
Chrome
### What development environment are you experiencing this bug on?
Local dev server
### Did you set the correct environment variables in the right path? List the environment variable names (not values please!)
_No response_
### Provide any additional context for the Bug.
Proposed fix:
In `application/api/user/attachments/routes.py`:
- Use `data = request.get_json(silent=True) or {}`
- Add explicit validation for `text` (ensure it is a non-empty string).
- Return a 400 response with `{"success": False, "message": "..."}` for invalid payloads.
- Update unit tests in `tests/api/user/attachments/test_routes.py` to cover empty and missing payload edge cases.
### Relevant log output
```shell
TypeError: 'NoneType' object is not subscriptable
KeyError: 'text'Have you spent some time to check if this bug has been raised before?
- I checked and didn't find similar issue
Are you willing to submit PR?
Yes, I am willing to submit a PR!
⚖️ Code of Conduct
- I agree to follow this project's Code of Conduct
Source: arc53/DocsGPT