Missing validation of generated image before saving in prompt_to_card_pipeline.py #14

New Issue

llabeyrie · 2026-03-19T17:31:05Z

llabeyrie commented

2026-03-19 17:31:05 +00:00

Description

In prompt_to_card_pipeline.py lines 230-242, the image generation result is used without sufficient validation:

result = self._pipe(conditioning, ...)

if not hasattr(result, "images") or not result.images:
    raise RuntimeError(...)

image = result.images[0]          # could still fail
if save_path:
    output_file = Path(save_path).resolve()
    output_file.parent.mkdir(parents=True, exist_ok=True)
    image.save(str(output_file))  # no error handling

Problems

result.images[0] could raise IndexError if images is an empty-like object that passes the truthiness check
No validation that image is actually a PIL Image before calling .save()
No exception handling for .save() failures (disk full, permission denied, invalid path)
No check that the saved file actually exists and has non-zero size after writing

Fix

Add explicit type check and wrap save in try/except:

from PIL import Image as PILImage

if not isinstance(image, PILImage.Image):
    raise TypeError(f"Expected PIL Image, got {type(image)}")

try:
    image.save(str(output_file))
except (OSError, IOError) as e:
    raise RuntimeError(f"Failed to save image to {output_file}: {e}") from e

## Description In `prompt_to_card_pipeline.py` lines 230-242, the image generation result is used without sufficient validation: ```python result = self._pipe(conditioning, ...) if not hasattr(result, "images") or not result.images: raise RuntimeError(...) image = result.images[0] # could still fail if save_path: output_file = Path(save_path).resolve() output_file.parent.mkdir(parents=True, exist_ok=True) image.save(str(output_file)) # no error handling ``` ### Problems - `result.images[0]` could raise `IndexError` if images is an empty-like object that passes the truthiness check - No validation that `image` is actually a PIL Image before calling `.save()` - No exception handling for `.save()` failures (disk full, permission denied, invalid path) - No check that the saved file actually exists and has non-zero size after writing ### Fix Add explicit type check and wrap save in try/except: ```python from PIL import Image as PILImage if not isinstance(image, PILImage.Image): raise TypeError(f"Expected PIL Image, got {type(image)}") try: image.save(str(output_file)) except (OSError, IOError) as e: raise RuntimeError(f"Failed to save image to {output_file}: {e}") from e ```

llabeyrie added the bug priority: medium labels 2026-03-19 17:31:49 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: llabeyrie/Juicepyter#14