backup

app.py

@@ -166,15 +166,19 @@ def get_annotated_indices(username):
     """Get list of dataset indices already annotated by this user"""
     filename = "data/evaluation_results_exp.csv"
     if not os.path.exists(filename):
+        print(f"No annotations found for user {username} (file doesn't exist)")
         return set()
 
     try:
         df = pd.read_csv(filename)
         if "dataset_idx" not in df.columns or "username" not in df.columns:
+            print(f"No annotations found for user {username} (missing columns)")
             return set()
         user_annotations = df[df["username"] == username]["dataset_idx"].tolist()
+        print(f"User {username} has already processed {len(user_annotations)} posts")
         return set(user_annotations)
     except:
+        print(f"Error reading annotations for user {username}")
         return set()
 
 
@@ -312,28 +316,79 @@ def select_verdict(verdict, state):
 
 
 def is_valid_email(email):
-    """Validate email format using regex pattern"""
+    """
+    Validate email format and content more strictly:
+    - Check basic email format
+    - Prevent common injection attempts
+    - Limit length
+    - Restrict to printable ASCII characters
+    """
+    if not email or not isinstance(email, str):
+        return False
+
+    # Check length limits
+    if len(email) > 254:  # Maximum length per RFC 5321
+        return False
+
+    # Remove any whitespace
+    email = email.strip()
+
+    # Check for common injection characters
+    dangerous_chars = [";", '"', "'", ",", "\\", "\n", "\r", "\t"]
+    if any(char in email for char in dangerous_chars):
+        return False
+
+    # Ensure all characters are printable ASCII
+    if not all(32 <= ord(char) <= 126 for char in email):
+        return False
+
+    # Validate email format using comprehensive regex
     pattern = r"^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$"
-    return bool(re.match(pattern, email))
+    if not re.match(pattern, email):
+        return False
+
+    # Additional checks for common patterns
+    if ".." in email:  # No consecutive dots
+        return False
+    if email.count("@") != 1:  # Exactly one @ symbol
+        return False
+
+    # Validate lengths of local and domain parts
+    local, domain = email.split("@")
+    if len(local) > 64 or len(domain) > 255:  # RFC 5321 limits
+        return False
+
+    return True
 
 
 def handle_username_submit(email, current_page):
-    """Handle email submission and advance to next page"""
-    if not email or not is_valid_email(email.strip()):
-        # Return current page and show error message
-        gr.Warning("Please enter a valid email address (e.g., [email protected])")
+    """Handle email submission with enhanced validation"""
+    try:
+        if not email:
+            gr.Warning("Please enter an email address")
+            return current_page, gr.update(value=email), gr.update(value=""), None
+
+        # Clean the input
+        email = str(email).strip()
+
+        if not is_valid_email(email):
+            gr.Warning("Please enter a valid email address (e.g., [email protected])")
+            return current_page, gr.update(value=email), gr.update(value=""), None
+
+        # Sanitize email for CSV storage
+        safe_email = email.replace('"', "").replace("'", "")
+
         return (
-            current_page,  # stay on current page
-            gr.update(value=email),  # keep current email value
-            gr.update(value=""),  # clear debug
-            None,  # no username state
+            2,  # next page
+            gr.update(value=""),  # clear input
+            gr.update(value=safe_email),  # update debug
+            safe_email,  # update state
         )
-    return (
-        2,  # next page
-        gr.update(value=""),  # clear input
-        gr.update(value=email),  # update debug
-        email,  # update state
-    )
+
+    except Exception as e:
+        print(f"Error in handle_username_submit: {str(e)}")
+        gr.Warning("An error occurred. Please try again.")
+        return current_page, gr.update(value=""), gr.update(value=""), None
 
 
 def initialize(username):