pook/compliancebot

Fork 0

Add input length validation on document generation fields to prevent prompt injection and cost overrun #97

New issue

Closed

opened 2026-04-08 18:21:03 -04:00 by pook · 1 comment

pook commented

2026-04-08 18:21:03 -04:00

Owner

Problem

Document generation accepts user-provided business details (company name, address, description, etc.) that are passed to the AI API. Without length limits, a malicious or accidental oversized input could cause prompt injection, excessive API costs, or timeouts.

Task

Define max character limits for each generation input field (e.g., company_name: 200, business_description: 2000, address: 500).
Validate all input fields against these limits before calling the AI API.
Return 422 with field-specific error messages for violations.
Add unit tests for boundary cases.

Acceptance Criteria

All generation input fields have documented max lengths
Oversized inputs rejected with 422 before AI API call
Error response identifies which field(s) exceeded limits
Unit tests for valid, boundary, and oversized inputs

Generated by CEO Planner (priority: 3)

## Problem Document generation accepts user-provided business details (company name, address, description, etc.) that are passed to the AI API. Without length limits, a malicious or accidental oversized input could cause prompt injection, excessive API costs, or timeouts. ## Task 1. Define max character limits for each generation input field (e.g., company_name: 200, business_description: 2000, address: 500). 2. Validate all input fields against these limits before calling the AI API. 3. Return 422 with field-specific error messages for violations. 4. Add unit tests for boundary cases. ## Acceptance Criteria - All generation input fields have documented max lengths - Oversized inputs rejected with 422 before AI API call - Error response identifies which field(s) exceeded limits - Unit tests for valid, boundary, and oversized inputs --- *Generated by CEO Planner (priority: 3)*

pook added the

agent-task

label

2026-04-08 18:21:03 -04:00

pook referenced this issue

2026-04-08 20:01:33 -04:00

Add input length limits on document generation fields — max 5000 chars per field #115

pook referenced this issue

2026-04-09 02:16:39 -04:00

Batch-close 5 stale issues superseded by newer scoped replacements #196

pook referenced this issue

2026-04-09 02:17:34 -04:00

Add input length limits on document generation fields — max 5000 chars per field #115

pook referenced this issue

2026-04-09 02:17:46 -04:00

[Agent] Issue #196: six issues are stale 6 8h no pr five of #198

pook referenced this issue

2026-04-09 04:02:53 -04:00

Add input length limits on document generation fields — max 5000 chars per field #115

pook referenced this issue

2026-04-09 04:23:56 -04:00

Add input length limits on document generation fields — max 5000 chars per field #115

pook commented

2026-04-10 14:48:29 -04:00

Author

Owner

Bulk-closed 2026-04-10 during pipeline triage.

Context: CEO agent had created 100 open agent-task issues against compliancebot, largely duplicates of each other and of the 50 currently-open PRs. Root cause traced to a git-push race in agent-worker executor (dispatch jobs collided on branch agent/dispatch/* because jobId prefix truncated to literal "dispatch"). Fix deployed: runId is now threaded from Paperclip shim through /dispatch → TaskJob → executor, and branches are keyed on a 12-char unique run key.

What to do next:

Triage the 50 open PRs at https://192.168.183.110:3000/pook/compliancebot/pulls — many are ready to merge
CEO should halt new task creation until open PRs drop below 10
Surviving kept issues: #313, #314, #315, #341, #342, #350, #351, #352 (PR review/merge tasks)

This issue was superseded, not abandoned. Reopen if still relevant after PR triage.

Bulk-closed 2026-04-10 during pipeline triage. **Context:** CEO agent had created 100 open agent-task issues against compliancebot, largely duplicates of each other and of the 50 currently-open PRs. Root cause traced to a git-push race in agent-worker executor (dispatch jobs collided on branch `agent/dispatch/*` because jobId prefix truncated to literal "dispatch"). Fix deployed: runId is now threaded from Paperclip shim through /dispatch → TaskJob → executor, and branches are keyed on a 12-char unique run key. **What to do next:** 1. Triage the 50 open PRs at https://192.168.183.110:3000/pook/compliancebot/pulls — many are ready to merge 2. CEO should halt new task creation until open PRs drop below 10 3. Surviving kept issues: #313, #314, #315, #341, #342, #350, #351, #352 (PR review/merge tasks) This issue was superseded, not abandoned. Reopen if still relevant after PR triage.

pook closed this issue

2026-04-10 14:48:30 -04:00

No labels

agent-task

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

pook/compliancebot#97

No description provided.

Rows
Columns