This is an automated email from the ASF dual-hosted git repository.
imbajin pushed a commit to branch goal-scan
in repository https://gitbox.apache.org/repos/asf/hugegraph-ai.git
The following commit(s) were added to refs/heads/goal-scan by this push:
new ef5cd605 fix(client): validate gremlin response payload
ef5cd605 is described below
commit ef5cd605a0de11c0023b6357ff8ad8b9ed6889e9
Author: imbajin <[email protected]>
AuthorDate: Wed Jun 3 11:17:55 2026 +0800
fix(client): validate gremlin response payload
- reject malformed Gremlin response payloads explicitly
- avoid leaking raw KeyError from ResponseData construction
- keep None response handling as the existing no-result path
- cover empty payload behavior with a focused regression test
---
hugegraph-python-client/src/pyhugegraph/api/gremlin.py | 4 ++++
hugegraph-python-client/src/tests/api/test_gremlin.py | 2 +-
2 files changed, 5 insertions(+), 1 deletion(-)
diff --git a/hugegraph-python-client/src/pyhugegraph/api/gremlin.py
b/hugegraph-python-client/src/pyhugegraph/api/gremlin.py
index 9875b075..71003686 100644
--- a/hugegraph-python-client/src/pyhugegraph/api/gremlin.py
+++ b/hugegraph-python-client/src/pyhugegraph/api/gremlin.py
@@ -22,6 +22,8 @@ from pyhugegraph.structure.response_data import ResponseData
from pyhugegraph.utils import huge_router as router
from pyhugegraph.utils.log import log
+_REQUIRED_RESPONSE_FIELDS = {"requestId", "status", "result"}
+
class GremlinManager(HugeParamsBase):
@router.http("POST", "/gremlin")
@@ -46,6 +48,8 @@ class GremlinManager(HugeParamsBase):
response = self._invoke_request(data=gremlin_data.to_json())
if response is not None:
+ if not isinstance(response, dict) or not
_REQUIRED_RESPONSE_FIELDS.issubset(response):
+ raise ValueError(f"Invalid Gremlin response payload:
{response}")
return ResponseData(response).result
log.error("Gremlin can't get results: %s", str(response))
return None
diff --git a/hugegraph-python-client/src/tests/api/test_gremlin.py
b/hugegraph-python-client/src/tests/api/test_gremlin.py
index a6934b52..59709584 100644
--- a/hugegraph-python-client/src/tests/api/test_gremlin.py
+++ b/hugegraph-python-client/src/tests/api/test_gremlin.py
@@ -173,5 +173,5 @@ def
test_gremlin_exec_does_not_silently_drop_empty_payload(monkeypatch):
gremlin = GremlinManager(_FailingGremlinSession())
monkeypatch.setattr(gremlin, "_invoke_request", mock.Mock(return_value={}))
- with pytest.raises(KeyError):
+ with pytest.raises(ValueError, match="Invalid Gremlin response payload"):
gremlin.exec("g.V()")
