gitea_admin/canalhandia
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: stop a malformed API key reaching a log line

Browse Source 
HttpRequest.Builder.header() quotes the offending header value back in
its IllegalArgumentException. Fuzzed on temurin-25: all 32 control
characters it rejects echo the value, so a key carrying any of them ends
up in whatever log catches the throw. A key file with a comment on line
two survives trim() and is enough to trigger it.

Ai.cleanKey now takes the first non-blank line and drops control
characters, so a malformed key never forms. HttpFetcher.checkBearer
rejects one anyway before the request is built, with a message naming
only the position, so no future caller has to remember to redact. Its
reject set is a strict superset of the JDK's.

Also renames MiniMax.Msg to MiniMax.Turn: the package already has a
top-level Msg, the chat-formatting helper, which the record shadowed
inside MiniMax.java.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F3jSvSTrG4qsniLSr6TpC6
This commit is contained in:
marcos
2026-08-05 16:05:22 +00:00
parent 6e0167cff1
commit 88fe9c9695
6 changed files with 224 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/dev/marcospaulo/canalhandia/MiniMax.java
+14 -7
View File
@@ -59,8 +59,15 @@ final class MiniMax {
*/
private static final double TERM_TEMPERATURE = 0.0;
/** One message in the request. */
record Msg(String role, String content) {
/**
* One message in the request.
*
* <p>Named {@code Turn} and not {@code Msg} because the package already has
* a top-level {@link Msg}, the chat-formatting helper. A nested record of
* that name would shadow it inside this file, so a later {@code Msg.error}
* here would resolve to the record instead.
*/
record Turn(String role, String content) {
}
private final Fetcher fetcher;
@@ -103,8 +110,8 @@ final class MiniMax {
*/
String searchTerm(String key, String model, String question) {
JsonObject body = base(model, List.of(
new Msg("system", "Você escolhe qual artigo da Minecraft Wiki consultar."),
new Msg("user", question)), TERM_TOKENS, TERM_TEMPERATURE);
new Turn("system", "Você escolhe qual artigo da Minecraft Wiki consultar."),
new Turn("user", question)), TERM_TOKENS, TERM_TEMPERATURE);
body.add("tools", JsonParser.parseString(TOOLS).getAsJsonArray());
body.add("tool_choice", JsonParser.parseString(TOOL_CHOICE).getAsJsonObject());
@@ -146,7 +153,7 @@ final class MiniMax {
* spends the whole allowance thinking and returns nothing at all. Measured
* twice at 400 tokens, which is why answers are given 1200.
*/
String answer(String key, String model, List<Msg> messages, int maxTokens, double temperature) {
String answer(String key, String model, List<Turn> messages, int maxTokens, double temperature) {
JsonObject message = message(post(key, base(model, messages, maxTokens, temperature)));
if (message == null) {
return null;
@@ -160,9 +167,9 @@ final class MiniMax {
return content.getAsString();
}
private JsonObject base(String model, List<Msg> messages, int maxTokens, double temperature) {
private JsonObject base(String model, List<Turn> messages, int maxTokens, double temperature) {
JsonArray array = new JsonArray();
for (Msg msg : messages) {
for (Turn msg : messages) {
JsonObject object = new JsonObject();
object.addProperty("role", msg.role());
object.addProperty("content", msg.content());