Skip to content

fix: [Q&A Page] The agent's logo still displays the default icon instead of the custom logo. #7836

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shaohuzhang1 merged 1 commit into from
Nov 11, 2026
Merged

fix: [Q&A Page] The agent's logo still displays the default icon instead of the custom logo. #7836

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion apps/common/middleware/chat_headers_middleware.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ def process_response(self, request, response):
response.content = (
response.content.decode("utf-8")
.replace(
'<link rel="icon" href="./favicon.ico" />', f'<link rel="icon" href="{application_icon}" />'
'<link rel="icon" href="/chat/favicon.ico" />', f'<link rel="icon" href="{application_icon}" />'
)
.replace("<title>MaxKB</title>", f"<title>{application_name}</title>")
.encode("utf-8")

@shaohuzhang1 shaohuzhang1 Nov 11, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review & Suggestions

1. Critical Issue: String Replacement vs. Regex/Parser

Issue: Using .replace() on HTML content is fragile and error-prone.

  • Brittleness: If the HTML structure changes slightly (e.g., whitespace, quotes, attribute ordering, or self-closing tags), the replacement will fail silently.
  • Performance: For large responses, string operations are less efficient than targeted parsing, though this is minor compared to the correctness risk.
  • Security: Simple string replacement does not handle HTML context safely (e.g., if application_name contains HTML special characters like <, >, &, they must be escaped before injection to prevent XSS or rendering issues).

Suggestion:
Use a proper HTML parser (like BeautifulSoup) or regex with caution. However, for Django middleware, a safer and faster pattern is to use regex if you must stay lightweight, or better yet, template variables/context passed via Django’s response API if possible.

If you must stick to string manipulation for performance/minimal dependency reasons:

  • Ensure application_icon and application_name are HTML-escaped using django.utils.html.escape.
  • Use regex to handle variations in attribute formatting.

2. Encoding/Decoding Overhead

Issue: The code decodes UTF-8, modifies the string, and re-encodes it. This is expensive for large responses and can break binary or non-UTF-8 encoded responses.

Suggestion:

  • Check if the response MIME type is HTML (response.content_type.startswith('text/html')).
  • Only perform this operation on HTML responses.

3. Hardcoded Patterns

Issue: The patterns ' /chat/favicon.ico"' and '<title>MaxKB</title>' are hardcoded. If the frontend framework or static file serving path shifts, this breaks.

Suggestion:
Make these constants configurable or derived from settings.

Optimized Example

Here is a more robust approach using Regex (lighter than BeautifulSoup) and escaping:

import re
from django.utils.html import escape

# Compile patterns once for performance if this middleware is often hit
FAVICON_RE = re.compile(
    r'<link\s+[^>]*rel=["\']icon["\'][^>]*href=["\'][^"\']*favicon\.ico["\'][^>]*/?>',
    re.IGNORECASE
)
TITLE_RE = re.compile(r'(<title>)(.*?)(</title>)', re.IGNORECASE | re.DOTALL)

def process_response(self, request, response):
    # Only process HTML responses
    if response.content_type.startswith('text/html') and not response.streaming:
        try:
            html_content = response.content.decode('utf-8')
            
            # Escape values to prevent injection/rendering issues
            safe_icon = escape(application_icon)
            safe_name = escape(application_name)

            # Replace favicon link
            html_content = FAVICON_RE.sub(
                f'<link rel="icon" href="{safe_icon}" />', 
                html_content
            )

            # Replace title
            def replace_title(match):
                return f'{match.group(1)}{safe_name}{match.group(3)}'
            
            html_content = TITLE_RE.sub(replace_title, html_content)

            response.content = html_content.encode('utf-8')
        except UnicodeDecodeError:
            pass # Skip if not valid UTF-8
        except Exception:
            pass # Log error, but do not crash request processing
        
    return response

Key Improvements:

  1. Robust Matching: Regex handles attribute order variations and extra spaces.
  2. Safety: Uses html.escape to prevent broken HTML/XSS if application_name contains special chars.
  3. Performance Guard: Skips non-HTML or streaming responses.
  4. Error Handling: Prevents middleware from crashing the entire request if decoding fails.

Final Note

If your frontend generates the favicon/title dynamically via JS/CSP, consider configuring the backend to send headers or metadata instead of mutating the DOM stringly-typedly.

Expand Down
Loading