You're offline — showing cached data

MC-3441

[LegalMind] Analyze endpoint accepts unvalidated AI temperature from request body
2026-06-13 06:14:43 SAST
Home Board MC-3441

[LegalMind] Analyze endpoint accepts unvalidated AI temperature from request body

The POST /api/documents/:id/analyze endpoint destructures a temperature field from req.body (line 409) and passes it directly to AI API calls (line 457) without range validation...
State Done Next Action Closed Owner Luci Runtime Closed Age 29d ago
MC-3441
Ticket is done; runtime is closed. · profile claude_opus_1m_medium · cwd /home/lucienne/workspace · uptime 29d 3h · last activity 29d 1h ago

Description

MC-3441
The POST /api/documents/:id/analyze endpoint destructures a temperature field from req.body (line 409) and passes it directly to AI API calls (line 457) without range validation. The user settings route enforces a 0-2 range for extractionTemperature, but the per-request override bypasses this check. A caller can submit extreme values (e.g., -100 or 9999) that may cause AI API errors or garbage output. Should validate the request temperature against the same 0-2 range before use. File: server/routes/documents.ts:409 Complexity: simple Found by: nightly code review (3a243848 Merge pull request #401 from conrelma/fix/mc-3430-bundle-extra-page-end) Auto-fix skipped: Luci-side scheduled autofix is disabled by default; Larry owns LegalMind code changes.

Activity

done
Luci is working...
Live
No activity yet
Help