add feature to download image or video file created locally #1606

varungup90 · 2025-09-25T19:48:58Z

Pull Request Description

Create an image or video


- kubectl -n envoy-gateway-system port-forward service/envoy-aibrix-system-aibrix-eg-903790dc  8888:80

- curl -v "http://localhost:8888/v1/video/generations" \
        -H "Content-Type: application/json" \
        -d '{
           "prompt": "a cute rabbit",
           "model": "hunyuan-dit",
           "save_disk_path": "/shared/2026"
         }'
* Host localhost:8888 was resolved.
* IPv6: ::1
* IPv4: 127.0.0.1
*   Trying [::1]:8888...
* Connected to localhost (::1) port 8888
> POST /v1/video/generations HTTP/1.1
> Host: localhost:8888
> User-Agent: curl/8.9.1
> Accept: */*
> Content-Type: application/json
> Content-Length: 101
> 
* upload completely sent off: 101 bytes
< HTTP/1.1 200 OK
< date: Thu, 25 Sep 2025 20:01:14 GMT
< server: uvicorn
< content-type: application/json
< x-went-into-req-headers: true
< request-id: eb618df8-9260-46e8-870a-9b81e6032412
< target-pod: **10.0.1.147**:6000
< transfer-encoding: chunked
< 
* Connection #0 to host localhost left intact
{"message":"Video generated successfully","elapsed_time":"111.93 sec","output":"/shared/2026/generated_video_20250925-200306.mp4","save_to_disk":true}


- ip is from the target-pod return in the response. port is aibrix-runtime running as a side car container.

- curl -X POST http://localhost:8888/view \
  -H "Content-Type: application/json" \
  --data '{
    "ip": "10.0.1.147", 
    "port": "8080", 
    "path": "//shared/2026/generated_video_20250925-200306.mp4"
  }' \
  -o generated_video_20250925-200306.mp4

Related Issues

Resolves: #[Insert issue number(s)]

Important: Before submitting, please complete the description above and review the checklist below.

Contribution Guidelines (Expand for Details)

We appreciate your contribution to aibrix! To ensure a smooth review process and maintain high code quality, please adhere to the following guidelines:

Pull Request Title Format

Your PR title should start with one of these prefixes to indicate the nature of the change:

[Bug]: Corrections to existing functionality
[CI]: Changes to build process or CI pipeline
[Docs]: Updates or additions to documentation
[API]: Modifications to aibrix's API or interface
[CLI]: Changes or additions to the Command Line Interface
[Misc]: For changes not covered above (use sparingly)

Note: For changes spanning multiple categories, use multiple prefixes in order of importance.

Submission Checklist

PR title includes appropriate prefix(es)
Changes are clearly explained in the PR description
New and existing tests pass successfully
Code adheres to project style and best practices
Documentation updated to reflect changes (if applicable)
Thorough testing completed, no regressions introduced

By submitting this PR, you confirm that you've read these guidelines and your changes align with the project's contribution standards.

gemini-code-assist · 2025-09-25T19:49:51Z

Summary of Changes

Hello @varungup90, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the system by enabling the download of locally created media files. It establishes a new /view endpoint in both the Go backend and the Python FastAPI application. The Go endpoint acts as a proxy, allowing clients to request files from internal services, while the FastAPI endpoint directly serves files from the local filesystem with proper content handling. Additionally, the gateway logic has been updated to intelligently route image generation requests based on the presence of a save_disk_path parameter, and necessary Python dependencies have been added.

Highlights

File Download Feature: Introduced a new capability to download locally generated image or video files through dedicated endpoints.
Go Backend Endpoint: Added a /view POST endpoint in the Go service (pkg/metadata/handlers.go) to proxy file download requests from specified IP, port, and path.
Python Frontend Endpoint: Implemented a /view/{file_path:path} GET endpoint in the Python FastAPI application (python/aibrix/aibrix/app.py) to serve local files securely, handling content types and disposition.
Image Generation Routing Logic: Modified the gateway's request body validation to detect and apply random routing for image generation requests that include a save_disk_path.
Dependency Update: Integrated aiofiles into the Python project dependencies to support asynchronous file operations.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces a feature to download files, but in doing so, it adds two critical security vulnerabilities: a Server-Side Request Forgery (SSRF) in the Go code and a Path Traversal vulnerability in the Python code. Both of these issues could allow an attacker to access internal services or sensitive files on the server. These must be addressed before merging. Additionally, there are a few medium-severity issues related to maintainability and an unused dependency that should be cleaned up.

gemini-code-assist · 2025-09-25T19:51:46Z

pkg/metadata/handlers.go

+	if req.IP == "" {
+		http.Error(w, "missing required parameter: ip", http.StatusBadRequest)
+		return
+	}
+	if req.Port == "" {
+		http.Error(w, "missing required parameter: port", http.StatusBadRequest)
+		return
+	}
+	if req.Path == "" {
+		http.Error(w, "missing required parameter: path", http.StatusBadRequest)
+		return
+	}
+	if !strings.HasPrefix(req.Path, "/") {
+		req.Path = "/" + req.Path
+	}
+
+	// Construct the download URL
+	downloadURL := fmt.Sprintf("http://%s:%s/view%s", req.IP, req.Port, req.Path)
+	klog.Infof("Attempting to download file from: %s", downloadURL)


This handler introduces a critical Server-Side Request Forgery (SSRF) vulnerability. The IP and Port parameters are taken directly from the user's request body and used to construct a downloadURL. An attacker can abuse this to make the server send requests to arbitrary internal services, including localhost, or scan the internal network. You should never trust user input to construct request URLs directly.

To fix this, you must validate the IP against an allowlist of trusted hosts, or at a minimum, block requests to private, loopback, and link-local IP address ranges.

gemini-code-assist · 2025-09-25T19:51:46Z

python/aibrix/aibrix/app.py

+@router.get("/view/{file_path:path}")
+async def view_file_complete(file_path: str):
+    """
+    Return the entire file for download using path parameter.
+    Usage: GET /view/etc/hosts or GET /view/tmp/myfile.txt
+    """
+    try:
+        # Ensure absolute path
+        if not file_path.startswith('/'):
+            file_path = '/' + file_path
+
+        # Validate that the file exists
+        if not os.path.exists(file_path):
+            raise HTTPException(status_code=404, detail=f"File not found: {file_path}")


This endpoint introduces a critical Path Traversal vulnerability. It allows a user to specify an arbitrary file_path in the URL, which is then used to serve a file from the server's filesystem. An attacker could use this to read sensitive files like /etc/passwd, configuration files, or source code by providing payloads like ../../../../etc/passwd.

To fix this, you must restrict file access to a designated, safe directory. The user-provided path should be treated as relative and joined with a secure base directory. You must also ensure that the final resolved path is still within this safe directory to prevent traversal attacks.

gemini-code-assist · 2025-09-25T19:51:46Z

pkg/metadata/handlers.go

+	if req.IP == "" {
+		http.Error(w, "missing required parameter: ip", http.StatusBadRequest)
+		return
+	}
+	if req.Port == "" {
+		http.Error(w, "missing required parameter: port", http.StatusBadRequest)
+		return
+	}
+	if req.Path == "" {
+		http.Error(w, "missing required parameter: path", http.StatusBadRequest)
+		return


The validation for required parameters is done in separate if blocks. This is repetitive and can be consolidated for better readability and maintainability. Consider checking all parameters at once and returning a single, more informative error message listing all missing fields.

gemini-code-assist · 2025-09-25T19:51:46Z

pkg/plugins/gateway/util.go

+		_, ok := jsonMap["save_disk_path"]
+		if ok && routingCtx.Algorithm == routing.RouterNotSet {
+			routingCtx.Algorithm = routing.RouterRandom
+		}


This logic implicitly changes the routing algorithm to RouterRandom if save_disk_path is present in the request. This behavior is not obvious and could be surprising for future maintainers. For better maintainability, please add a comment explaining the reason for this logic.

Suggested change

_, ok := jsonMap["save_disk_path"]

if ok && routingCtx.Algorithm == routing.RouterNotSet {

routingCtx.Algorithm = routing.RouterRandom

}

_, ok := jsonMap["save_disk_path"]

// If `save_disk_path` is specified, the request may need to be routed to a specific pod

// that can save the file. If no routing algorithm is set, default to random routing.

if ok && routingCtx.Algorithm == routing.RouterNotSet {

routingCtx.Algorithm = routing.RouterRandom

}

python/aibrix/aibrix/app.py

Signed-off-by: varungupta <varungup90@gmail.com>

gemini-code-assist bot reviewed Sep 25, 2025

View reviewed changes

varungup90 force-pushed the add-view-endpoint branch from ca209df to e559291 Compare September 25, 2025 20:13

varungup90 marked this pull request as draft September 25, 2025 20:48

varungup90 added 5 commits September 29, 2025 15:33

add feature to download image or video file created locally

842121e

Signed-off-by: varungupta <varungup90@gmail.com>

fix lint error

853ed13

Signed-off-by: varungupta <varungup90@gmail.com>

fix formatting

72b3be8

Signed-off-by: varungupta <varungup90@gmail.com>

nit

b02378b

Signed-off-by: varungupta <varungup90@gmail.com>

refactor to use file storage

5aa802d

Signed-off-by: varungupta <varungup90@gmail.com>

varungup90 force-pushed the add-view-endpoint branch from 24905ca to f1f1cba Compare September 29, 2025 22:50

fix lint error

f4a9655

Signed-off-by: varungupta <varungup90@gmail.com>

varungup90 force-pushed the add-view-endpoint branch from f1f1cba to f4a9655 Compare September 29, 2025 22:52

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

add feature to download image or video file created locally #1606

add feature to download image or video file created locally #1606

Uh oh!

varungup90 commented Sep 25, 2025 •

edited

Loading

Uh oh!

gemini-code-assist bot commented Sep 25, 2025

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

gemini-code-assist bot Sep 25, 2025

Uh oh!

gemini-code-assist bot Sep 25, 2025

Uh oh!

gemini-code-assist bot Sep 25, 2025

Uh oh!

gemini-code-assist bot Sep 25, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

add feature to download image or video file created locally #1606

Are you sure you want to change the base?

add feature to download image or video file created locally #1606

Uh oh!

Conversation

varungup90 commented Sep 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Description

Related Issues

Pull Request Title Format

Submission Checklist

Uh oh!

gemini-code-assist bot commented Sep 25, 2025

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Sep 25, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

varungup90 commented Sep 25, 2025 •

edited

Loading