fix(tts): reject unsupported routes and error documents (#261)

Return 501 for unsupported Edge server plugin and SpeechT5 routes instead of falling through to frontend assets.

Reject explicit upstream HTML/JSON audio responses with 502, including MiniMax audio downloads. Reuse existing HTTP test support for focused behavior coverage.

Validation: pnpm run check.
This commit is contained in:
Darkatse 2026-09-16 18:26:51 -04:00
parent 6bbc1e2f16
commit 69d75d7d26
3 changed files with 171 additions and 79 deletions

View file

@ -146,6 +146,9 @@ async fn bytes_response(
if !response.status().is_success() {
return upstream_error_response(response, &format!("{label} failed")).await;
}
if let Some(message) = unexpected_content_type(&response, fallback_content_type) {
return Ok(TtsRouteResponse::text(502, format!("{label}: {message}")));
}
let content_type = if preserve_content_type {
response_content_type(&response, fallback_content_type)
} else {
@ -157,6 +160,24 @@ async fn bytes_response(
Ok(TtsRouteResponse::bytes(200, content_type, body.to_vec()))
}
fn unexpected_content_type(response: &Response, expected: &str) -> Option<String> {
let actual = response_content_type(response, expected);
let media_type = actual
.split(';')
.next()
.unwrap_or_default()
.trim()
.to_ascii_lowercase();
let is_json = media_type == "application/json" || media_type.ends_with("+json");
if matches!(media_type.as_str(), "text/html" | "application/xhtml+xml")
|| (expected.starts_with("audio/") && is_json)
{
Some(format!("Expected {expected}, got {actual}"))
} else {
None
}
}
fn response_content_type(response: &Response, fallback: &str) -> String {
response
.headers()
@ -214,7 +235,54 @@ fn parse_json_error_message(payload: &Value) -> Option<String> {
#[cfg(test)]
mod tests {
use super::parse_upstream_error_message;
use std::sync::Arc;
use tokio::io::{AsyncReadExt, AsyncWriteExt};
use tokio::net::{TcpListener, TcpStream};
use super::{HttpTtsRepository, parse_upstream_error_message};
use tt_adapter_http::HttpClientPool;
use tt_ports::repositories::tts_repository::{OpenAiTtsRequest, TtsRepository, TtsRequest};
#[tokio::test]
async fn openai_compatible_rejects_error_documents_and_preserves_audio_bytes() {
let repository = HttpTtsRepository::new(Arc::new(HttpClientPool::new("TauriTavern/test")));
for (content_type, body, status) in [
(
"text/html; charset=utf-8",
b"<!DOCTYPE html>".to_vec(),
502,
),
(
"application/json",
br#"{"error":"invalid voice"}"#.to_vec(),
502,
),
("application/octet-stream", vec![0, 1, 255], 200),
] {
let (url, server) = spawn_one_response(200, content_type, body.clone()).await;
let response = repository
.handle(TtsRequest::OpenAi(OpenAiTtsRequest::CompatibleGenerate {
api_key: None,
endpoint: url.parse().unwrap(),
input: "hello".into(),
voice: "test".into(),
model: "test".into(),
response_format: "mp3".into(),
speed: 1.0,
}))
.await
.unwrap();
server.await.unwrap();
assert_eq!(response.status, status, "{content_type}");
if status == 200 {
assert_eq!(response.body, body);
} else {
assert!(String::from_utf8(response.body).unwrap().contains(content_type));
}
}
}
#[test]
fn parses_nested_json_error_message() {
@ -242,4 +310,63 @@ mod tests {
"Request failed"
);
}
pub(super) async fn spawn_one_response(
status: u16,
content_type: &'static str,
body: Vec<u8>,
) -> (String, tokio::task::JoinHandle<String>) {
let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
let url = format!("http://{}", listener.local_addr().unwrap());
let handle = tokio::spawn(async move {
let (mut stream, _addr) = listener.accept().await.unwrap();
let request = read_http_request(&mut stream).await;
let response_head = format!(
"HTTP/1.1 {status} OK\r\nContent-Type: {content_type}\r\nContent-Length: {}\r\nConnection: close\r\n\r\n",
body.len()
);
stream.write_all(response_head.as_bytes()).await.unwrap();
stream.write_all(&body).await.unwrap();
request
});
(url, handle)
}
async fn read_http_request(stream: &mut TcpStream) -> String {
let mut bytes = Vec::new();
let header_end = loop {
let mut buffer = [0_u8; 1024];
let read = stream.read(&mut buffer).await.unwrap();
assert!(read > 0, "client closed connection before sending headers");
bytes.extend_from_slice(&buffer[..read]);
if let Some(index) = find_header_end(&bytes) {
break index;
}
};
let headers = String::from_utf8_lossy(&bytes[..header_end]).to_string();
let content_length = headers
.lines()
.find_map(|line| {
let (name, value) = line.split_once(':')?;
name.eq_ignore_ascii_case("content-length")
.then(|| value.trim().parse::<usize>().ok())
.flatten()
})
.unwrap_or(0);
let expected_len = header_end + 4 + content_length;
while bytes.len() < expected_len {
let mut buffer = [0_u8; 1024];
let read = stream.read(&mut buffer).await.unwrap();
assert!(
read > 0,
"client closed connection before sending full body"
);
bytes.extend_from_slice(&buffer[..read]);
}
String::from_utf8_lossy(&bytes[..expected_len]).to_string()
}
fn find_header_end(bytes: &[u8]) -> Option<usize> {
bytes.windows(4).position(|window| window == b"\r\n\r\n")
}
}

View file

@ -1,7 +1,7 @@
use reqwest::header::{ACCEPT, CONTENT_TYPE};
use serde_json::{Value, json};
use super::{parse_json_error_message, send_with_retry};
use super::{parse_json_error_message, send_with_retry, unexpected_content_type};
use tt_domain::errors::DomainError;
use tt_ports::repositories::tts_repository::{MinimaxGenerateRequest, TtsRouteResponse};
@ -104,6 +104,12 @@ pub(super) async fn generate(
return upstream_error_response(audio_response, "MiniMax TTS audio URL request failed")
.await;
}
if let Some(message) = unexpected_content_type(&audio_response, audio_content_type) {
return Ok(error_response(
502,
format!("MiniMax TTS audio URL request: {message}"),
));
}
let audio = audio_response.bytes().await.map_err(|error| {
DomainError::InternalError(format!(
"MiniMax TTS audio URL response read failed: {error}"
@ -233,9 +239,8 @@ fn hex_nibble(byte: u8) -> Result<u8, String> {
#[cfg(test)]
mod tests {
use serde_json::{Value, json};
use tokio::io::{AsyncReadExt, AsyncWriteExt};
use tokio::net::{TcpListener, TcpStream};
use super::super::tests::spawn_one_response;
use super::{decode_hex_audio, generate, parse_base_response_error, parse_upstream_error};
use tt_ports::repositories::tts_repository::MinimaxGenerateRequest;
@ -313,24 +318,36 @@ mod tests {
}
#[tokio::test]
async fn fetches_audio_url_response() {
let (audio_url, audio_server) =
spawn_one_response(200, "audio/mpeg", vec![10, 11, 12]).await;
let body = format!(
r#"{{"data":{{"url":"{audio_url}/audio.mp3"}},"base_resp":{{"status_code":0}}}}"#
)
.into_bytes();
let (api_host, api_server) = spawn_one_response(200, "application/json", body).await;
async fn fetches_audio_url_and_rejects_error_documents() {
for (content_type, audio, status) in [
("audio/mpeg", vec![10, 11, 12], 200),
("text/html", b"<!DOCTYPE html>".to_vec(), 502),
] {
let (audio_url, audio_server) =
spawn_one_response(200, content_type, audio.clone()).await;
let body = format!(
r#"{{"data":{{"url":"{audio_url}/audio.mp3"}},"base_resp":{{"status_code":0}}}}"#
)
.into_bytes();
let (api_host, api_server) = spawn_one_response(200, "application/json", body).await;
let response = generate(reqwest::Client::new(), minimax_request(api_host, None))
.await
.unwrap();
let api_request = api_server.await.unwrap();
let audio_request = audio_server.await.unwrap();
let response = generate(reqwest::Client::new(), minimax_request(api_host, None))
.await
.unwrap();
let api_request = api_server.await.unwrap();
let audio_request = audio_server.await.unwrap();
assert_eq!(response.body, [10, 11, 12]);
assert!(api_request.starts_with("POST /v1/t2a_v2 HTTP/1.1"));
assert!(audio_request.starts_with("GET /audio.mp3 HTTP/1.1"));
assert_eq!(response.status, status);
if status == 200 {
assert_eq!(response.body, audio);
} else {
assert_eq!(response.content_type, "application/json; charset=utf-8");
let error: Value = serde_json::from_slice(&response.body).unwrap();
assert!(error["error"].as_str().unwrap().contains(content_type));
}
assert!(api_request.starts_with("POST /v1/t2a_v2 HTTP/1.1"));
assert!(audio_request.starts_with("GET /audio.mp3 HTTP/1.1"));
}
}
#[tokio::test]
@ -369,65 +386,6 @@ mod tests {
}
}
async fn spawn_one_response(
status: u16,
content_type: &'static str,
body: Vec<u8>,
) -> (String, tokio::task::JoinHandle<String>) {
let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
let url = format!("http://{}", listener.local_addr().unwrap());
let handle = tokio::spawn(async move {
let (mut stream, _addr) = listener.accept().await.unwrap();
let request = read_http_request(&mut stream).await;
let response_head = format!(
"HTTP/1.1 {status} OK\r\nContent-Type: {content_type}\r\nContent-Length: {}\r\nConnection: close\r\n\r\n",
body.len()
);
stream.write_all(response_head.as_bytes()).await.unwrap();
stream.write_all(&body).await.unwrap();
request
});
(url, handle)
}
async fn read_http_request(stream: &mut TcpStream) -> String {
let mut bytes = Vec::new();
let header_end = loop {
let mut buffer = [0_u8; 1024];
let read = stream.read(&mut buffer).await.unwrap();
assert!(read > 0, "client closed connection before sending headers");
bytes.extend_from_slice(&buffer[..read]);
if let Some(index) = find_header_end(&bytes) {
break index;
}
};
let headers = String::from_utf8_lossy(&bytes[..header_end]).to_string();
let content_length = headers
.lines()
.find_map(|line| {
let (name, value) = line.split_once(':')?;
name.eq_ignore_ascii_case("content-length")
.then(|| value.trim().parse::<usize>().ok())
.flatten()
})
.unwrap_or(0);
let expected_len = header_end + 4 + content_length;
while bytes.len() < expected_len {
let mut buffer = [0_u8; 1024];
let read = stream.read(&mut buffer).await.unwrap();
assert!(
read > 0,
"client closed connection before sending full body"
);
bytes.extend_from_slice(&buffer[..read]);
}
String::from_utf8_lossy(&bytes[..expected_len]).to_string()
}
fn find_header_end(bytes: &[u8]) -> Option<usize> {
bytes.windows(4).position(|window| window == b"\r\n\r\n")
}
fn request_body_json(request: &str) -> Value {
let body = request
.split_once("\r\n\r\n")

View file

@ -58,6 +58,13 @@ async function handleTtsRoute(context, path, body) {
}
export function registerTtsRoutes(router, context) {
router.all('/api/plugins/edge-tts/*', () => textResponse(
'Edge TTS server plugins are not supported by TauriTavern.', 501, 'Not Implemented',
));
router.post('/api/speech/synthesize', () => textResponse(
'SpeechT5 is not implemented in the TauriTavern native backend.', 501, 'Not Implemented',
));
const routes = [
'/api/azure/list',
'/api/azure/generate',