From 5200b71e2b94b25cf60181ec20ee18610fa23170 Mon Sep 17 00:00:00 2001 From: Yiorgis Gozadinos Date: Mon, 27 Jul 2026 12:17:39 +0300 Subject: [PATCH] Correct two justifications Drop the coverage-gate CHANGELOG entry: it is dev infrastructure, invisible to anyone upgrading. Broaden the check_source_accessible entry to the cases it now covers. The nameless-attachment guard reads an empty /F out of untrusted PDF bytes, so it is boundary validation, not a formality; only the reason it goes uncovered belongs in the pragma. --- CHANGELOG.md | 6 +----- haiku_rag_slim/haiku/rag/client/documents.py | 5 ++++- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 64452693..8a98db2e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,14 +1,10 @@ # Changelog ## [Unreleased] -### Changed - -- Test coverage is enforced at 100% via `fail_under` in `[tool.coverage.report]`. - ### Fixed - `Store.set_haiku_version` stamps the store's own config into a recreated settings row instead of the process-global `Config`. -- `check_source_accessible` returns `False` for a URI that fails to parse instead of raising `ValueError`. +- `check_source_accessible` returns `False` for a URI it cannot resolve (unparseable host, unreadable path) instead of raising and aborting a full rebuild. ### Removed diff --git a/haiku_rag_slim/haiku/rag/client/documents.py b/haiku_rag_slim/haiku/rag/client/documents.py index a9698ce5..8cb916e4 100644 --- a/haiku_rag_slim/haiku/rag/client/documents.py +++ b/haiku_rag_slim/haiku/rag/client/documents.py @@ -570,7 +570,10 @@ def _extract_pdf_attachments( for i in range(attachment_count): att = pdf.get_attachment(i) name = att.get_name() - if not name: # pragma: no cover - pypdfium2 always names them + # A malformed PDF can carry an attachment with an empty /F, so + # this is real validation on untrusted input — it just needs a + # hand-crafted file to reach, which no fixture here produces. + if not name: # pragma: no cover - needs a malformed PDF continue data = bytes(att.get_data()) child_uri = f"{parent_uri}#attachment={quote(name, safe='')}"