Description
The /api/diagnose endpoint (backend/main.py, diagnose() function) accepts an uploaded image and validates only the file extension, never the file size:
pythonext = (file.filename or "").lower().split(".")[-1]
if ext not in {"png", "jpg", "jpeg", "webp"}:
raise HTTPException(status_code=400, detail="Only PNG/JPG/JPEG/WEBP images are accepted")
contents = await file.read()
result = run_inference(contents)
file.read() loads the entire upload into memory regardless of size, then passes it directly to PIL and the ResNet18/CLIP inference pipeline. The frontend (CropScanTab.tsx, line ~131) only checks file.type.startsWith('image/'), also with no size check. There's no server- or platform-level cap anywhere else in the repo either (no Dockerfile, no MAX_CONTENT_LENGTH, no Nginx config).
What I expected: uploading an oversized image (e.g. a 30–50MB raw phone photo) should be rejected early with a clear 413 Payload Too Large response, both from the API and with immediate client-side feedback before the file is even sent.
What actually happens: the file is fully read into memory and pushed through inference with no limit, which on a memory-constrained host (this is deployed to Hugging Face Spaces / Railway free tiers per the README) risks slow requests, memory exhaustion, or a crashed worker under a single large or malicious upload.
Steps to reproduce
1.Authenticate and call POST /api/diagnose with a valid JWT.
2.Attach a very large image file (e.g. >25MB, still a valid .jpg/.png).
3.Observe that the request is accepted and processed rather than rejected, with no size check occurring before file.read() and inference.
4.Repeat with several large/concurrent uploads to observe memory pressure on the backend process.
Environment
OS : ubuntu24.04.4 LTS
browser : chrome
Logs / screenshots
No response
@jpdevhub I would like to implement this fand contribute to the project as part of SSoC '26. Could you please assign this issue to me?
Description
The /api/diagnose endpoint (backend/main.py, diagnose() function) accepts an uploaded image and validates only the file extension, never the file size:
pythonext = (file.filename or "").lower().split(".")[-1]
if ext not in {"png", "jpg", "jpeg", "webp"}:
raise HTTPException(status_code=400, detail="Only PNG/JPG/JPEG/WEBP images are accepted")
contents = await file.read()
result = run_inference(contents)
file.read() loads the entire upload into memory regardless of size, then passes it directly to PIL and the ResNet18/CLIP inference pipeline. The frontend (CropScanTab.tsx, line ~131) only checks file.type.startsWith('image/'), also with no size check. There's no server- or platform-level cap anywhere else in the repo either (no Dockerfile, no MAX_CONTENT_LENGTH, no Nginx config).
What I expected: uploading an oversized image (e.g. a 30–50MB raw phone photo) should be rejected early with a clear 413 Payload Too Large response, both from the API and with immediate client-side feedback before the file is even sent.
What actually happens: the file is fully read into memory and pushed through inference with no limit, which on a memory-constrained host (this is deployed to Hugging Face Spaces / Railway free tiers per the README) risks slow requests, memory exhaustion, or a crashed worker under a single large or malicious upload.
Steps to reproduce
1.Authenticate and call POST /api/diagnose with a valid JWT.
2.Attach a very large image file (e.g. >25MB, still a valid .jpg/.png).
3.Observe that the request is accepted and processed rather than rejected, with no size check occurring before file.read() and inference.
4.Repeat with several large/concurrent uploads to observe memory pressure on the backend process.
Environment
OS : ubuntu24.04.4 LTS
browser : chrome
Logs / screenshots
No response
@jpdevhub I would like to implement this fand contribute to the project as part of SSoC '26. Could you please assign this issue to me?