Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion remote_config/keys.py
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,7 @@
REF_CACHE_LIMIT_KEY = "feature.text.ref_cache_limit"
ENABLE_WEBPAGES = "feature.webpages.enable"
CLIENT_REMOTE_CONFIG_JSON = "feature.client.remote_config_json"
EXPIRE_LEGACY_COOKIES = "feature.cookies.expire_legacy"
EXPIRE_LEGACY_COOKIES = "feature.cookies.expire_legacy"

# Chatbot configuration
CHATBOT_MAX_INPUT_CHARS = "feature.chatbot.max_input_chars"
4 changes: 4 additions & 0 deletions sefaria/system/context_processors.py
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,8 @@
from sefaria.utils.chatbot import build_chatbot_user_token
from sefaria.utils.hebrew import hebrew_parasha_name
from reader.views import render_react_component, _get_user_calendar_params
from remote_config import remoteConfigCache
from remote_config.keys import CHATBOT_MAX_INPUT_CHARS

import structlog
logger = structlog.get_logger(__name__)
Expand Down Expand Up @@ -127,8 +129,10 @@ def chatbot_user_token(request):
if not getattr(profile, "experiments", False):
return {"chatbot_user_token": None, "chatbot_enabled": False}
token = build_chatbot_user_token(request.user.id, CHATBOT_USER_ID_SECRET)
max_input_chars = remoteConfigCache.get(CHATBOT_MAX_INPUT_CHARS, default=500)
return {
"chatbot_user_token": token,
"chatbot_enabled": True,
"chatbot_api_base_url": settings.CHATBOT_API_BASE_URL,
"chatbot_max_input_chars": max_input_chars,
}
Comment on lines +132 to 138
Copy link

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

remoteConfigCache.get() can return non-int values (e.g., if the admin creates this key with value_type=string, which is the model default). Since max-input-chars is presumably consumed as a number by the chatbot widget, this can lead to broken/bypassed limits or runtime errors. Consider coercing to int with a safe fallback to 500, and clamp to a reasonable min/max (e.g., >=1 and an upper bound) to avoid misconfiguration causing excessive client payloads/costs.

Suggested change
max_input_chars = remoteConfigCache.get(CHATBOT_MAX_INPUT_CHARS, default=500)
return {
"chatbot_user_token": token,
"chatbot_enabled": True,
"chatbot_api_base_url": settings.CHATBOT_API_BASE_URL,
"chatbot_max_input_chars": max_input_chars,
}
# Safely coerce remote config value to int with sane defaults and bounds
raw_max_input_chars = remoteConfigCache.get(CHATBOT_MAX_INPUT_CHARS, default=500)
default_max_input_chars = 500
min_max_input_chars = 1
max_max_input_chars = 20000
try:
max_input_chars = int(raw_max_input_chars)
except (TypeError, ValueError):
max_input_chars = default_max_input_chars
else:
if max_input_chars < min_max_input_chars:
max_input_chars = min_max_input_chars
elif max_input_chars > max_max_input_chars:
max_input_chars = max_max_input_chars
return:
{
"chatbot_user_token": token,
"chatbot_enabled": True,
"chatbot_api_base_url": settings.CHATBOT_API_BASE_URL,
"chatbot_max_input_chars": max_input_chars,
}

Copilot uses AI. Check for mistakes.
1 change: 1 addition & 0 deletions templates/base.html
Original file line number Diff line number Diff line change
Expand Up @@ -235,6 +235,7 @@
api-base-url="{{ chatbot_api_base_url }}"
default-open="false"
placement="right"
max-input-chars="{{ chatbot_max_input_chars }}"
></lc-chatbot>
{% endif %}

Expand Down
Loading