fix(salting): mount router, add CLI harness, fix script reference - #1012
Merged
Userunknown84 merged 1 commit intoJul 29, 2026
Merged
Conversation
/api/salting/* was completely unreachable: the router was never required or app.use()'d in server.js, and even after mounting it pointed at a nonexistent text_salting_detector.js instead of the real text_salting_detector.py. - Require and mount saltingRoutes at /api/poisoning's sibling path, /api/salting, matching the existing mounting convention. - Fix SALTING_SCRIPT's path to point at the .py file that actually exists. - text_salting_detector.py had no --command/--params CLI handling at all (only a hardcoded demo in __main__), so even a correct path reference wouldn't have produced usable JSON for the Node side to parse. Added a run_cli() harness matching the --command/--params contract already established by multi_level_defense.py, exposing 'detect' and 'status'; the no-args demo behavior is preserved. - Two of the render/OCR failure-path print() calls wrote warnings to stdout, which would have corrupted the JSON response whenever rendering or OCR failed (a very likely path in real deployments, not just this sandbox) - redirected both to stderr. - Fixed a genuine ZeroDivisionError in detect()'s "hidden text exceeds visible text" branch, triggered whenever OCR extracts zero visible text and hidden content is below the 100-char fast-path threshold - reuses the already-safe hidden/(visible+1) ratio instead of a second, unguarded hidden/visible division. Verified end-to-end via the exact spawn() call routes/saltingRoutes.js uses: --command status and --command detect both return clean, single-JSON-object stdout (confirmed by installing the real opencv-python/pytesseract/html2image deps from requirements.txt and exercising real HTML with hidden content), with render/OCR warnings correctly routed to stderr instead of polluting stdout. Closes Userunknown84#1001
|
Someone is attempting to deploy a commit to the Aditya Sharma's projects Team on Vercel. A member of the Team first needs to authorize it. |
Userunknown84
approved these changes
Jul 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1001
Problem
/api/salting/*was completely unreachable: the router was never requiredor
app.use()'d inserver.js, and even mounted it pointed at anonexistent
text_salting_detector.jsinstead of the realtext_salting_detector.py.Fix
saltingRoutesat/api/salting, matching theexisting convention (sibling to
/api/poisoning).SALTING_SCRIPT's path to the.pyfile that actually exists.text_salting_detector.pyhad no--command/--paramsCLI handling atall — only a hardcoded demo in
__main__. Even a correct path referencewouldn't have produced usable JSON. Added a
run_cli()harness matchingthe contract already established by
multi_level_defense.py, exposingdetectandstatus; the no-args demo behavior is preserved.print()calls wrote warnings to stdout,which would corrupt the JSON response whenever rendering or OCR fails (a
likely real-world path, not just a sandbox quirk) — redirected both to
stderr.
ZeroDivisionErrorindetect()'s "hidden text exceedsvisible text" branch, triggered whenever OCR extracts zero visible text
and hidden content is under the 100-char fast-path threshold.
Verification
Verified end-to-end via the exact
spawn()callsaltingRoutes.jsuses:--command statusand--command detectboth return clean, single-JSON-objectstdout — confirmed by installing the real
opencv-python/pytesseract/html2imagedeps fromrequirements.txtand running actual HTML withhidden content through it, with render/OCR warnings correctly routed to
stderr instead of polluting stdout.