🐛(backend) strip whitespace from media URLs in CORS proxy

[maboukerfa]

Purpose

Fixes an issue where media URLs with leading or trailing whitespace fail to download via the CORS proxy during PDF export, resulting in missing images in the exported PDF.

Screen.Recording.2026-03-15.at.16.18.45.mov

Proposal

Added .strip() to the URL query parameter in the CORS proxy endpoint to handle URLs with accidental leading/trailing whitespace.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 59c7449b-bcf2-4c1a-9044-53606fc8c45a

📥 Commits

Reviewing files that changed from the base of the PR and between 94b7f40 and c67000c.

📒 Files selected for processing (2)

• src/backend/core/api/viewsets.py
• src/backend/core/tests/documents/test_api_documents_cors_proxy.py

---

Walkthrough

The cors_proxy endpoint now normalizes the incoming url query parameter by defaulting missing values to an empty string and stripping leading/trailing whitespace before the existing presence check, unquote processing, scheme-restricted URL validation, SSRF validation, and the outbound requests.get proxying flow. A new test verifies that a whitespace-padded url query parameter is accepted, triggers the proxied fetch (with mocked DNS and HTTP), returns HTTP 200, preserves Content-Type, and streams the proxied content.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: stripping whitespace from media URLs in the CORS proxy, which directly matches the changeset modifications.
Description check	✅ Passed	The description is directly related to the changeset, explaining the bug fix (whitespace handling in CORS proxy URLs) and the solution implemented.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/backend/core/api/viewsets.py`:
- Line 2069: The code calls request.query_params.get("url").strip() which raises
AttributeError if the "url" param is missing; change it to safely handle None by
first retrieving the raw param (e.g., raw_url = request.query_params.get("url"))
and then either use raw_url = raw_url or raw_url = "" if None (or use
request.query_params.get("url", "")) before calling .strip(); ensure the
subsequent logic that checks if not url still returns the expected 400 response.
Update the assignment (replace the problematic url =
request.query_params.get("url").strip() line) in the view handling the docs CORS
proxy so the code normalizes and validates the URL without calling .strip() on
None.

In `@src/backend/core/tests/documents/test_api_documents_cors_proxy.py`:
- Around line 73-77: The registered responses mock uses the padded URL string so
it doesn't match the actual request after the view strips whitespace; change the
mock registration to use the stripped URL (e.g., assign stripped_url =
url_to_fetch.strip() and call responses.get(stripped_url,...)) while still
passing the original padded url_to_fetch into client.get's querystring, and add
a second test that calls the endpoint with ?url= omitted or blank and asserts a
400 response to prevent the None.strip() regression referenced in viewsets.py
(around the strip call).

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: e91efa4c-b2ab-4a36-8d60-49a3bf2686d9

📥 Commits

Reviewing files that changed from the base of the PR and between e747e03 and 94b7f40.

📒 Files selected for processing (2)

• src/backend/core/api/viewsets.py
• src/backend/core/tests/documents/test_api_documents_cors_proxy.py

[maboukerfa]

@lunika, can you please re-run the tests actions, thanx