Skip to content

fix(daemon): avoid custom attachment upload header #9567

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ytahdn merged 1 commit into from
Aug 20, 2026
Merged

fix(daemon): avoid custom attachment upload header #9567

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 3 additions & 10 deletions packages/cli/src/serve/routes/session.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4416,29 +4416,22 @@ export function registerSessionRoutes(
withOwnerMutableSession(
'POST /session/:id/attachments',
async (req, res, sessionId, runtime) => {
const encodedName = req.headers['x-qwen-attachment-name'];
const name = req.query['name'];
const contentType = req.headers['content-type']
?.split(';', 1)[0]
?.trim()
.toLowerCase();
if (
typeof encodedName !== 'string' ||
typeof name !== 'string' ||
!contentType ||
!Buffer.isBuffer(req.body)
) {
res.status(400).json({
error:
'request body, Content-Type, and X-Qwen-Attachment-Name are required',
'request body, Content-Type, and name query parameter are required',
});
return;
}
let name: string;
try {
name = decodeURIComponent(encodedName);
} catch {
res.status(400).json({ error: 'attachment name is invalid' });
return;
}
const clientId = parseClientIdHeader(req, res);
if (clientId === null) return;
if (
Expand Down
29 changes: 16 additions & 13 deletions packages/cli/src/serve/server.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9576,10 +9576,10 @@ describe('createServeApp', () => {
);
const uploaded = await request(app)
.post('/session/s-1/attachments')
.query({ name: 'notes 你好.txt' })
.set('Host', `127.0.0.1:${baseOpts.port}`)
.set('Authorization', 'Bearer secret')
.set('Content-Type', 'text/plain')
.set('X-Qwen-Attachment-Name', encodeURIComponent('notes 你好.txt'))
.send(Buffer.from('hello'));

expect(uploaded.status).toBe(201);
Expand All @@ -9599,10 +9599,10 @@ describe('createServeApp', () => {
);
const uploaded = await request(app)
.post('/session/s-1/attachments')
.query({ name: 'empty.txt' })
.set('Host', `127.0.0.1:${baseOpts.port}`)
.set('Authorization', 'Bearer secret')
.set('Content-Type', 'text/plain')
.set('X-Qwen-Attachment-Name', 'empty.txt')
.set('Content-Length', '0')
.send(Buffer.alloc(0));

Expand All @@ -9623,10 +9623,10 @@ describe('createServeApp', () => {
);
const uploaded = await request(app)
.post('/session/s-1/attachments')
.query({ name: 'empty.png' })
.set('Host', `127.0.0.1:${baseOpts.port}`)
.set('Authorization', 'Bearer secret')
.set('Content-Type', 'image/png')
.set('X-Qwen-Attachment-Name', 'empty.png')
.set('Content-Length', '0')
.send(Buffer.alloc(0));

Expand All @@ -9644,10 +9644,10 @@ describe('createServeApp', () => {
);
const uploaded = await request(app)
.post('/SESSION/s-1/ATTACHMENTS')
.query({ name: 'notes.txt' })
.set('Host', `127.0.0.1:${baseOpts.port}`)
.set('Authorization', 'Bearer secret')
.set('Content-Type', 'text/plain')
.set('X-Qwen-Attachment-Name', 'notes.txt')
.send(Buffer.from('hello'));

expect(uploaded.status).toBe(201);
Expand All @@ -9665,10 +9665,10 @@ describe('createServeApp', () => {
);
const uploaded = await request(app)
.post('/session/s-1/attachments')
.query({ name: 'data.json' })
.set('Host', `127.0.0.1:${baseOpts.port}`)
.set('Authorization', 'Bearer secret')
.set('Content-Type', 'application/json')
.set('X-Qwen-Attachment-Name', 'data.json')
.send('{"enabled":true}');

expect(uploaded.status).toBe(201);
Expand All @@ -9689,10 +9689,10 @@ describe('createServeApp', () => {
const bytes = Buffer.from([0x89, 0x50, 0x4e, 0x47]);
const uploaded = await request(app)
.post('/session/s-1/attachments')
.query({ name: 'image.png' })
.set('Host', `127.0.0.1:${baseOpts.port}`)
.set('Authorization', 'Bearer secret')
.set('Content-Type', 'image/png')
.set('X-Qwen-Attachment-Name', 'image.png')
.send(bytes);

expect(uploaded.status).toBe(201);
Expand Down Expand Up @@ -9742,22 +9742,25 @@ describe('createServeApp', () => {
expect(response.status).toBe(400);
});

it('rejects malformed encoded attachment names', async () => {
it('rejects repeated attachment name query parameters', async () => {
const app = createServeApp(
{ ...baseOpts, token: 'secret', workspace: WS_BOUND },
undefined,
{ bridge: fakeBridge() },
);
const response = await request(app)
.post('/session/s-1/attachments')
.query({ name: ['one.txt', 'two.txt'] })
.set('Host', `127.0.0.1:${baseOpts.port}`)
.set('Authorization', 'Bearer secret')
.set('Content-Type', 'text/plain')
.set('X-Qwen-Attachment-Name', '%E0%A4%A')
.send('hello');

expect(response.status).toBe(400);
expect(response.body).toEqual({ error: 'attachment name is invalid' });
expect(response.body).toEqual({
error:
'request body, Content-Type, and name query parameter are required',
});
});

it('maps attachment name and Content-Type mismatches to 400', async () => {
Expand All @@ -9772,10 +9775,10 @@ describe('createServeApp', () => {
);
const response = await request(app)
.post('/session/s-1/attachments')
.query({ name: 'screenshot.png' })
.set('Host', `127.0.0.1:${baseOpts.port}`)
.set('Authorization', 'Bearer secret')
.set('Content-Type', 'text/plain')
.set('X-Qwen-Attachment-Name', 'screenshot.png')
.send('hello');

expect(response.status).toBe(400);
Expand All @@ -9792,10 +9795,10 @@ describe('createServeApp', () => {
);
const response = await request(app)
.post('/session/s-1/attachments')
.query({ name: 'image.svg' })
.set('Host', `127.0.0.1:${baseOpts.port}`)
.set('Authorization', 'Bearer secret')
.set('Content-Type', 'image/svg+xml')
.set('X-Qwen-Attachment-Name', 'image.svg')
.send(Buffer.from('<svg xmlns="http://www.w3.org/2000/svg"></svg>'));

expect(response.status).toBe(201);
Expand All @@ -9818,10 +9821,10 @@ describe('createServeApp', () => {
const bytes = Buffer.from([0x89, 0x50, 0x4e, 0x47]);
const uploaded = await request(app)
.post('/session/s-1/attachments')
.query({ name: 'image.png' })
.set('Host', `127.0.0.1:${baseOpts.port}`)
.set('Authorization', 'Bearer secret')
.set('Content-Type', 'image/png')
.set('X-Qwen-Attachment-Name', 'image.png')
.send(bytes);
expect(uploaded.status).toBe(201);

Expand All @@ -9843,10 +9846,10 @@ describe('createServeApp', () => {
);
const response = await request(app)
.post('/session/s-1/attachments')
.query({ name: 'image.png' })
.set('Host', `127.0.0.1:${baseOpts.port}`)
.set('Authorization', 'Bearer secret')
.set('Content-Type', 'image/png')
.set('X-Qwen-Attachment-Name', 'image.png')
.send(Buffer.alloc(8 * 1024 * 1024 + 1));

expect(response.status).toBe(413);
Expand Down
10 changes: 2 additions & 8 deletions packages/sdk-typescript/src/daemon/DaemonClient.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3301,16 +3301,10 @@ export class DaemonClient {
opts?: { signal?: AbortSignal; clientId?: string },
): Promise<DaemonSessionAttachmentReference> {
return await this.fetchWithTimeout(
`${this.baseUrl}/session/${urlEncode(sessionId)}/attachments`,
`${this.baseUrl}/session/${urlEncode(sessionId)}/attachments?name=${urlEncode(name)}`,
{
method: 'POST',
headers: this.headers(
{
'Content-Type': mimeType,
'X-Qwen-Attachment-Name': encodeURIComponent(name),
},
opts?.clientId,
),
headers: this.headers({ 'Content-Type': mimeType }, opts?.clientId),
body: data,
signal: opts?.signal,
},
Expand Down
7 changes: 5 additions & 2 deletions packages/sdk-typescript/test/unit/DaemonSessionClient.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -737,7 +737,7 @@ describe('DaemonSessionClient', () => {
await expect(
session.uploadAttachment(
new Blob([Uint8Array.of(1, 2, 3)]),
'image.png',
'image 你好.png',
'image/png',
),
).resolves.toEqual(reference);
Expand All @@ -748,7 +748,10 @@ describe('DaemonSessionClient', () => {
'x-qwen-client-id': 'client-1',
}),
});
expect(calls[0]?.url).toContain('/session/s-1/attachments');
expect(calls[0]?.headers).not.toHaveProperty('x-qwen-attachment-name');
expect(calls[0]?.url).toBe(
'http://daemon/session/s-1/attachments?name=image%20%E4%BD%A0%E5%A5%BD.png',
);
});

it('removes session attachment through the authenticated session route', async () => {
Expand Down
Loading