fix: surface upload validation reason in metadata API errors - #3154
Open
FrankApiyo wants to merge 2 commits into
Open
FrankApiyo wants to merge 2 commits into
FrankApiyo wants to merge 2 commits into
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Metadata media-file uploads that failed strict validation returned only the generic "The uploaded file 'X' could not be validated." message. The actual reason (e.g. "CSV files must be UTF-8 encoded.") was logged but discarded, so API clients and the UI had no actionable detail. generic_upload_validation_error_message now accepts an optional reason and appends it. The serializer passes the caught UploadValidationError through. The default (no reason) is unchanged, so other callers and the generic-message contract are preserved. Validator reasons are static, non-sensitive rule descriptions, so surfacing them does not leak data. Adds a serializer test that uploads a CSV with a non-UTF-8 byte (0x92) and asserts the reason is surfaced. Updates the metadata viewset and SVG serializer assertions to match the file-identifying prefix.
Defence-in-depth for the CodeQL stack-trace-exposure finding: the reason appended to the generic upload error is now collapsed to a single line and length-capped (200 chars) before it can reach an API response. The caught UploadValidationError already carries only curated, non-sensitive messages, but this guarantees that even an unexpected value can never surface a multi-line traceback or oversized internal detail. Adds tests covering the appended-reason and sanitization behaviour.
FrankApiyo
force-pushed
the
fix/surface-upload-validation-reason
branch
from
June 30, 2026 13:11
9606c5e to
0814c77
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes / Features implemented
Metadata media-file uploads that fail strict validation returned only a generic "could not be validated" message — the actual reason was logged server-side and discarded. The API error now includes the validation reason, sanitized before it is surfaced.
Steps taken to verify this change does what is intended
Side effects of implementing this change
Before submitting this PR for review, please make sure you have:
Need help on this PR? Tag
/codesmithwith what you need. Autofix is disabled.