From 4c548ebc612433fc477d97312ce484e21315b3fd Mon Sep 17 00:00:00 2001
From: Kshitij <160704796+kshitij-ka@users.noreply.github.com>
Date: Sun, 3 May 2026 22:43:11 +0530
Subject: [PATCH] fix(server): validate JSON data, sanitize inputs, and harden
 query parsing.

---
 web/server/bridge/retrieve.py | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/web/server/bridge/retrieve.py b/web/server/bridge/retrieve.py
index 3eb8bee..7a8ca9d 100644
--- a/web/server/bridge/retrieve.py
+++ b/web/server/bridge/retrieve.py
@@ -42,6 +42,14 @@ def main():
         try:
             req = json.loads(raw_line)
             query = req.get("query", "")
+            if not isinstance(query, str):
+                query = str(query)
+            query = query.strip()
+            if not query:
+                response = {"error": "query must be a non-empty string"}
+                sys.stdout.write(json.dumps(response) + "\n")
+                sys.stdout.flush()
+                continue
             top_n = max(1, min(int(req.get("top_n", 5)), 20))
             results, latency = retriever.retrieve(query, top_n=top_n)
             response = {"results": results, "latency_seconds": round(latency, 4)}