File: humane_proxy/middleware/interceptor.py Description: The _extract_last_user_message function assumes that payload.get("messages") will always be a list. If a user maliciously or accidentally sends a string (e.g., {"messages": "not a list"}), the reversed(messages) call will iterate over the individual characters of the string. When it attempts to call msg.get("role") on a string character, it raises an AttributeError because strings do not have a .get() method. Impact: This results in an unhandled exception and a 500 Internal Server Error, dropping the request. An attacker can repeatedly send this payload to cause a Denial of Service on the proxy endpoint.
File: humane_proxy/middleware/interceptor.py Description: The _extract_last_user_message function assumes that payload.get("messages") will always be a list. If a user maliciously or accidentally sends a string (e.g., {"messages": "not a list"}), the reversed(messages) call will iterate over the individual characters of the string. When it attempts to call msg.get("role") on a string character, it raises an AttributeError because strings do not have a .get() method. Impact: This results in an unhandled exception and a 500 Internal Server Error, dropping the request. An attacker can repeatedly send this payload to cause a Denial of Service on the proxy endpoint.