Skip to content

fix: harden input validation, file safety, and error handling #227

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ankit1999 wants to merge 2 commits into
base: main
Choose a base branch
from
Open

fix: harden input validation, file safety, and error handling #227

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9c97815
feat: add custom HuggingFace voice model support
ankit1999 Mar 1, 2026
a7e698a
fix: harden input validation, file safety, and error handling
ankit1999 Mar 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 39 additions & 7 deletions app/src/components/Generation/FloatingGenerateBox.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,14 +7,17 @@ import { Form, FormControl, FormField, FormItem, FormMessage } from '@/component
import {
Select,
SelectContent,
SelectGroup,
SelectItem,
SelectLabel,
SelectTrigger,
SelectValue,
} from '@/components/ui/select';
import { Textarea } from '@/components/ui/textarea';
import { useToast } from '@/components/ui/use-toast';
import { LANGUAGE_OPTIONS } from '@/lib/constants/languages';
import { useGenerationForm } from '@/lib/hooks/useGenerationForm';
import { useModelStatus } from '@/lib/hooks/useModelStatus';
import { useProfile, useProfiles } from '@/lib/hooks/useProfiles';
import { useAddStoryItem, useStory } from '@/lib/hooks/useStories';
import { cn } from '@/lib/utils/cn';
Expand Down Expand Up @@ -46,6 +49,9 @@ export function FloatingGenerateBox({
const addStoryItem = useAddStoryItem();
const { toast } = useToast();

// Use shared hook for model status fetching and grouping
const { builtInModels, customModels } = useModelStatus();

// Calculate if track editor is visible (on stories route with items)
const hasTrackEditor = isStoriesRoute && currentStory && currentStory.items.length > 0;

Expand Down Expand Up @@ -173,7 +179,7 @@ export function FloatingGenerateBox({
'fixed right-auto',
isStoriesRoute
? // Position aligned with story list: after sidebar + padding, width 360px
'left-[calc(5rem+2rem)] w-[360px]'
'left-[calc(5rem+2rem)] w-[360px]'
: 'left-[calc(5rem+2rem)] w-[calc((100%-5rem-4rem)/2-1rem)]',
)}
style={{
Expand Down Expand Up @@ -414,12 +420,38 @@ export function FloatingGenerateBox({
</SelectTrigger>
</FormControl>
<SelectContent>
<SelectItem value="1.7B" className="text-xs text-muted-foreground">
Qwen3-TTS 1.7B
</SelectItem>
<SelectItem value="0.6B" className="text-xs text-muted-foreground">
Qwen3-TTS 0.6B
</SelectItem>
<SelectGroup>
<SelectLabel className="text-xs">Built-in</SelectLabel>
{builtInModels.length > 0 ? (
builtInModels.map((model) => {
const sizeValue = model.model_name.replace('qwen-tts-', '');
return (
<SelectItem key={model.model_name} value={sizeValue} className="text-xs text-muted-foreground">
{model.display_name}
</SelectItem>
);
})
) : (
<>
<SelectItem value="1.7B" className="text-xs text-muted-foreground">
Qwen3-TTS 1.7B
</SelectItem>
<SelectItem value="0.6B" className="text-xs text-muted-foreground">
Qwen3-TTS 0.6B
</SelectItem>
</>
)}
</SelectGroup>
{customModels.length > 0 && (
<SelectGroup>
<SelectLabel className="text-xs">Custom</SelectLabel>
{customModels.map((model) => (
<SelectItem key={model.model_name} value={model.model_name} className="text-xs text-muted-foreground">
{model.display_name}
</SelectItem>
))}
</SelectGroup>
)}
</SelectContent>
</Select>
<FormMessage className="text-xs" />
Expand Down
41 changes: 37 additions & 4 deletions app/src/components/Generation/GenerationForm.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,13 +14,16 @@ import { Input } from '@/components/ui/input';
import {
Select,
SelectContent,
SelectGroup,
SelectItem,
SelectLabel,
SelectTrigger,
SelectValue,
} from '@/components/ui/select';
import { Textarea } from '@/components/ui/textarea';
import { LANGUAGE_OPTIONS } from '@/lib/constants/languages';
import { useGenerationForm } from '@/lib/hooks/useGenerationForm';
import { useModelStatus } from '@/lib/hooks/useModelStatus';
import { useProfile } from '@/lib/hooks/useProfiles';
import { useUIStore } from '@/stores/uiStore';

Expand All @@ -30,6 +33,9 @@ export function GenerationForm() {

const { form, handleSubmit, isPending } = useGenerationForm();

// Use shared hook for model status fetching and grouping
const { builtInModels, customModels } = useModelStatus();
Copy link

@coderabbitai coderabbitai bot Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Prevent built-in/custom option overlap from hook classification.

builtInModels from useModelStatus is based on model_name.startsWith('qwen-tts'). A custom repo like qwen-tts/my-voice can appear in both groups and be misinterpreted in built-in mapping.

🔧 Proposed fix (in app/src/lib/hooks/useModelStatus.ts) 
-const builtInModels =
-  modelStatus?.models.filter((m) => m.model_name.startsWith('qwen-tts')) || [];
+const builtInModels =
+  modelStatus?.models.filter((m) => !m.is_custom && m.model_name.startsWith('qwen-tts-')) || [];
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@app/src/components/Generation/GenerationForm.tsx` at line 37, The hook
useModelStatus currently classifies builtInModels using
model_name.startsWith('qwen-tts'), which incorrectly flags repos like
"qwen-tts/my-voice" as built-in; update the predicate in useModelStatus (the
filter that builds builtInModels/customModels) to only treat true built-ins such
as the core qwen-tts identifier (e.g., model_name === 'qwen-tts' or match a
pattern that disallows a following '/'), for example replace
startsWith('qwen-tts') with a stricter check (exact equality or a regex like
/^qwen-tts($|[:@])/) so repo-qualified names with a slash go to customModels.


async function onSubmit(data: Parameters<typeof handleSubmit>[0]) {
await handleSubmit(data, selectedProfileId);
}
Expand Down Expand Up @@ -129,19 +135,46 @@ export function GenerationForm() {
name="modelSize"
render={({ field }) => (
<FormItem>
<FormLabel>Model Size</FormLabel>
<FormLabel>Model</FormLabel>
<Select onValueChange={field.onChange} defaultValue={field.value}>
<FormControl>
<SelectTrigger>
<SelectValue />
</SelectTrigger>
</FormControl>
<SelectContent>
<SelectItem value="1.7B">Qwen TTS 1.7B (Higher Quality)</SelectItem>
<SelectItem value="0.6B">Qwen TTS 0.6B (Faster)</SelectItem>
<SelectGroup>
<SelectLabel>Built-in</SelectLabel>
{builtInModels.length > 0 ? (
builtInModels.map((model) => {
// Map model_name (qwen-tts-1.7B) back to model_size value (1.7B)
const sizeValue = model.model_name.replace('qwen-tts-', '');
return (
<SelectItem key={model.model_name} value={sizeValue}>
{model.display_name}
</SelectItem>
);
})
) : (
<>
<SelectItem value="1.7B">Qwen TTS 1.7B (Higher Quality)</SelectItem>
<SelectItem value="0.6B">Qwen TTS 0.6B (Faster)</SelectItem>
</>
)}
</SelectGroup>
{customModels.length > 0 && (
<SelectGroup>
<SelectLabel>Custom</SelectLabel>
{customModels.map((model) => (
<SelectItem key={model.model_name} value={model.model_name}>
{model.display_name}
</SelectItem>
))}
</SelectGroup>
)}
</SelectContent>
</Select>
<FormDescription>Larger models produce better quality</FormDescription>
<FormDescription>Select voice generation model</FormDescription>
<FormMessage />
</FormItem>
)}
Expand Down
Loading