Initial AI Assistant implementation (fixes #8) #13

kadraman · 2025-09-16T09:37:41Z

No description provided.

iwa/blueprints/assistant/assistant_routes.py

Copilot

Pull Request Overview

This PR implements an AI Assistant feature for the InsecureWebApp application, fixing issue #8. The AI Assistant uses OpenAI's API to provide a chat interface where users can ask health-related questions and receive responses from an AI assistant.

Adds a complete AI Assistant blueprint with chat functionality
Integrates OpenAI API for conversational AI responses
Updates navigation to include AI Assistant link
Updates documentation for static analysis and Debricked scanning

Reviewed Changes

Copilot reviewed 9 out of 11 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
iwa/templates/base.html	Adds styles block and AI Assistant navigation link
iwa/blueprints/assistant/templates/assistant/index.html	Complete chat interface template with message display and input form
iwa/blueprints/assistant/static/css/assistant.css	Comprehensive styling for the chat interface components
iwa/blueprints/assistant/assistant_routes.py	Backend logic for OpenAI integration and chat endpoints
iwa/blueprints/assistant/init.py	Blueprint initialization and registration
iwa/init.py	Registers the assistant blueprint with the application
etc/InsecureWebApp-Prod-Login.webmacro	Updates encrypted configuration file
README.md	Adds documentation for static analysis scanning commands
.github/workflows/debricked.yml	Simplifies Debricked scanning workflow to use GitHub Actions

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-09-16T09:40:05Z

iwa/blueprints/assistant/assistant_routes.py

+# Initialize the OpenAI client
+api_key = os.getenv("OPENAI_API_KEY")
+if api_key:
+    logger.debug("OPENAI_API_KEY: %s", api_key)


Logging the full API key in debug mode exposes sensitive credentials in log files. Consider logging only a masked version (e.g., first/last 4 characters) or removing this debug statement entirely.

Suggested change

logger.debug("OPENAI_API_KEY: %s", api_key)

masked_key = api_key[:4] + "*" * (len(api_key) - 8) + api_key[-4:] if len(api_key) > 8 else "*" * len(api_key)

logger.debug("OPENAI_API_KEY: %s", masked_key)

Copilot · 2025-09-16T09:40:05Z

iwa/blueprints/assistant/assistant_routes.py

+# Initialize the assistant and thread globally
+assistant_id = ""
+thread_id = ""


Using global variables for assistant_id and thread_id creates potential race conditions in multi-threaded environments. These should be stored per-session or user to avoid conflicts between concurrent users.

Copilot · 2025-09-16T09:40:05Z

iwa/blueprints/assistant/assistant_routes.py

+# Define a global chat history
+chat_history = [
+    {"role": "system", "content": "You are a helpful assistant."},
+]


Global chat_history will be shared across all users and sessions, causing privacy issues and data corruption. Chat history should be stored per-session using Flask's session object or a database.

Suggested change

# Define a global chat history

chat_history = [

{"role": "system", "content": "You are a helpful assistant."},

]

# Chat history will be stored per-session using Flask's session object.

# To initialize chat history for a session, use:

# if 'chat_history' not in session:

# session['chat_history'] = [{"role": "system", "content": "You are a helpful assistant."}]

Copilot · 2025-09-16T09:40:06Z

iwa/blueprints/assistant/assistant_routes.py

+
+@assistant_bp.route('/chat', methods=['POST'])
+def chat():
+    content = request.json["message"]


Missing input validation allows potential crashes if request.json is None or doesn't contain 'message' key. Add proper validation and error handling to prevent server errors from malformed requests.

Suggested change

content = request.json["message"]

if not request.is_json:

return jsonify(success=False, message="Request must be JSON"), 400

data = request.get_json()

if not data or "message" not in data:

return jsonify(success=False, message="Missing 'message' in request"), 400

content = data["message"]

Copilot · 2025-09-16T09:40:06Z

iwa/blueprints/assistant/assistant_routes.py

+    while run.status != "completed":
+        time.sleep(0.5)
+        run = client.beta.threads.runs.retrieve(thread_id=thread_id, run_id=run.id)
+


This infinite loop with polling could hang indefinitely if the OpenAI API fails or returns an unexpected status. Add a timeout mechanism and maximum retry count to prevent blocking the application.

Suggested change

while run.status != "completed":

time.sleep(0.5)

run = client.beta.threads.runs.retrieve(thread_id=thread_id, run_id=run.id)

max_retries = 40 # 0.5s * 40 = 20 seconds max wait

retries = 0

while run.status != "completed" and retries < max_retries:

time.sleep(0.5)

run = client.beta.threads.runs.retrieve(thread_id=thread_id, run_id=run.id)

retries += 1

if run.status != "completed":

logger.error("OpenAI API run did not complete after %d retries.", max_retries)

return jsonify(success=False, message="The AI Assistant did not respond in time. Please try again later.")

Copilot · 2025-09-16T09:40:06Z

iwa/blueprints/assistant/templates/assistant/index.html

+
+        // Load IDs
+        $.getJSON("/assistant/get_ids", function (data) {
+            console.log("Data: ", data, "Assistant ID: ", data.assistant_id, "Thread ID: ", data.thread_id);


Logging sensitive data like assistant and thread IDs to the browser console exposes internal system information. Remove or replace with non-sensitive debug information.

Suggested change

console.log("Data: ", data, "Assistant ID: ", data.assistant_id, "Thread ID: ", data.thread_id);

// Successfully fetched assistant and thread IDs.

Copilot · 2025-09-16T09:40:07Z

iwa/blueprints/assistant/templates/assistant/index.html

+
+                    var messageDiv = $("<div>").addClass(msg.role === "user" ? "user-message" : "assistant-message");
+                    var html = converter.makeHtml(msg.content);
+                    console.log(html);


Console.log statements should be removed from production code as they can expose user conversation content and clutter browser console output.

Suggested change

console.log(html);

Copilot · 2025-09-16T09:40:07Z

iwa/blueprints/assistant/templates/assistant/index.html

+                            typingIndicatorContainer.remove();
+
+                            var html = converter.makeHtml(data.message);
+                            console.log(html);


Console.log statements should be removed from production code as they can expose user conversation content and clutter browser console output.

Suggested change

console.log(html);

Initial AI Assistant implementation (fixes #8)

efaa10c

kadraman requested a review from Copilot September 16, 2025 09:37

github-advanced-security bot found potential problems Sep 16, 2025

View reviewed changes

iwa/blueprints/assistant/assistant_routes.py Dismissed Show dismissed Hide dismissed

kadraman self-assigned this Sep 16, 2025

kadraman merged commit b57cc61 into main Sep 16, 2025
8 checks passed

kadraman deleted the ai-assistant branch September 16, 2025 09:39

Copilot AI reviewed Sep 16, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Initial AI Assistant implementation (fixes #8) #13

Initial AI Assistant implementation (fixes #8) #13

Uh oh!

kadraman commented Sep 16, 2025

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Sep 16, 2025

Uh oh!

Copilot AI Sep 16, 2025

Uh oh!

Copilot AI Sep 16, 2025

Uh oh!

Copilot AI Sep 16, 2025

Uh oh!

Copilot AI Sep 16, 2025

Uh oh!

Copilot AI Sep 16, 2025

Uh oh!

Copilot AI Sep 16, 2025

Uh oh!

Copilot AI Sep 16, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	logger.debug("OPENAI_API_KEY: %s", api_key)
	masked_key = api_key[:4] + "" (len(api_key) - 8) + api_key[-4:] if len(api_key) > 8 else "" len(api_key)
	logger.debug("OPENAI_API_KEY: %s", masked_key)

-# Define a global chat history
-chat_history = [
-    {"role": "system", "content": "You are a helpful assistant."},
-]
+# Chat history will be stored per-session using Flask's session object.
+# To initialize chat history for a session, use:
+# if 'chat_history' not in session:
+#     session['chat_history'] = [{"role": "system", "content": "You are a helpful assistant."}]

-    content = request.json["message"]
+    if not request.is_json:
+        return jsonify(success=False, message="Request must be JSON"), 400
+    data = request.get_json()
+    if not data or "message" not in data:
+        return jsonify(success=False, message="Missing 'message' in request"), 400
+    content = data["message"]

-    while run.status != "completed":
-        time.sleep(0.5)
-        run = client.beta.threads.runs.retrieve(thread_id=thread_id, run_id=run.id)
+    max_retries = 40  # 0.5s * 40 = 20 seconds max wait
+    retries = 0
+    while run.status != "completed" and retries < max_retries:
+        time.sleep(0.5)
+        run = client.beta.threads.runs.retrieve(thread_id=thread_id, run_id=run.id)
+        retries += 1
+    if run.status != "completed":
+        logger.error("OpenAI API run did not complete after %d retries.", max_retries)
+        return jsonify(success=False, message="The AI Assistant did not respond in time. Please try again later.")

	console.log("Data: ", data, "Assistant ID: ", data.assistant_id, "Thread ID: ", data.thread_id);
	// Successfully fetched assistant and thread IDs.

Initial AI Assistant implementation (fixes #8) #13

Initial AI Assistant implementation (fixes #8) #13

Uh oh!

Conversation

kadraman commented Sep 16, 2025

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Sep 16, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 16, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 16, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 16, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 16, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 16, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 16, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 16, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants