A damaged image is refused in words, not with a 500 (#1065) #1066

Merged

claude-bot merged 2 commits from fix/map-upload-500 into main 2026-10-04 04:30:04 +00:00

Conversation 0 Commits 2 Files changed 4 +169 -24

claude-bot commented 2026-10-04 03:38:25 +00:00

Collaborator

Copy link

Closes #1065.

Summary

An image whose header reads but whose pixel data is broken answered 500 {"detail":"Internal server error"}. image_service.validate_and_reencode guarded only Image.open and verify(); the pixels are decoded later, in the re-encode, which was outside the try. The re-encode is now inside the guard and raises ImageError("This image is damaged or incomplete, so it could not be read."), which every caller (map images, page pictures, attachments, imports) already turns into a 422.

Found while reproducing a map-upload 500 in the journeys stack. A sound image uploads and tiles correctly there; of 23 variants tried, only the three damaged ones gave a 500.

Changelog

• changelog.d/damaged-image-upload-500.fixed.md

Test plan

• Failing first: at the test-only commit, 6 failed with the same OSError as the live traceback.
• With the fix: the new test_damaged_image_upload.py, a route test in tests/wiki/test_maps_api.py (422, no image kept, tiles_status "none"), plus tests/wiki, tests/export and the enqueue tests: 865 passed.
• ruff format and check clean; changelog and version checks OK.
• Also seen in the running stack (journeys, main's images): a valid 800×600 PNG uploaded through nginx, tiled to ready and served its tile. A 4.1 MB PNG returned 200 through nginx, which confirms #1058's limit in a running build.
• Not run: the full backend suite (CI), and this fix inside a rebuilt e2e image.

🤖 Generated with Claude Code

Closes #1065. ## Summary An image whose header reads but whose pixel data is broken answered `500 {"detail":"Internal server error"}`. `image_service.validate_and_reencode` guarded only `Image.open` and `verify()`; the pixels are decoded later, in the re-encode, which was outside the `try`. The re-encode is now inside the guard and raises `ImageError("This image is damaged or incomplete, so it could not be read.")`, which every caller (map images, page pictures, attachments, imports) already turns into a 422. Found while reproducing a map-upload 500 in the journeys stack. A sound image uploads and tiles correctly there; of 23 variants tried, only the three damaged ones gave a 500. ## Changelog - [x] `changelog.d/damaged-image-upload-500.fixed.md` ## Test plan - [x] **Failing first:** at the test-only commit, 6 failed with the same `OSError` as the live traceback. - [x] **With the fix:** the new `test_damaged_image_upload.py`, a route test in `tests/wiki/test_maps_api.py` (422, no image kept, `tiles_status` "none"), plus `tests/wiki`, `tests/export` and the enqueue tests: 865 passed. - [x] ruff format and check clean; changelog and version checks OK. - [x] **Also seen in the running stack** (journeys, main's images): a valid 800×600 PNG uploaded through nginx, tiled to `ready` and served its tile. A 4.1 MB PNG returned 200 through nginx, which confirms #1058's limit in a running build. - [ ] Not run: the full backend suite (CI), and this fix inside a rebuilt e2e image. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 2 commits 2026-10-04 03:38:26 +00:00

test: a damaged image upload is a 422, not a 500 (failing) ... f66d21c405

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fix(webapp): a damaged image upload is refused with a 422 instead of a 500 ... 9d8217ec5f

validate_and_reencode guarded only Image.open and verify(), which read the
header and (for a PNG) chunk checksums. The pixels are decoded later, in the
re-encode, which was outside the try: a JPEG cut short or a PNG with broken
image data raised OSError there and the route answered 500. The re-encode is
now inside the guard and raises ImageError, which every caller (map image,
attachment, page picture, import) already turns into a refusal.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude-bot merged commit 7d80758f84 into main 2026-10-04 04:30:04 +00:00

claude-bot deleted branch fix/map-upload-500 2026-10-04 04:30:05 +00:00

claude-bot referenced this pull request from a commit 2026-10-04 04:30:06 +00:00

Merge PR #1066: a damaged image upload is refused in words, not with a 500 (#1065)

claude-bot referenced this pull request 2026-10-04 04:30:13 +00:00

A damaged image upload answers 500 instead of a worded refusal #1065

claude-bot referenced this pull request 2026-10-04 06:57:21 +00:00

chore(release): v4.5.0-rc3 #1073

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

backend

Issue related to the backend

  

bot

Issue related to the bot

  

bug

Something is not working

  

duplicate

This issue or pull request already exists

  

enhancement

New feature

  

frontend

Issue related to the frontend

  

help wanted

Need some help

  

invalid

Something is wrong

  

question

More information is needed

  

recording

Issue related to the recording system

  

security

Security hardening / vulnerability work

  

wontfix

This won't be fixed

No labels

backend

bot

bug

duplicate

enhancement

frontend

help wanted

invalid

question

recording

security

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

rbrooks/Quest-Board!1066

No description provided.