Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions hud/agents/base.py
Original file line number Diff line number Diff line change
Expand Up @@ -968,4 +968,9 @@ def find_content(result: MCPToolResult) -> str | None:
return value
except json.JSONDecodeError:
pass
if not isinstance(json_content,dict):
continue

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Possible NameError referencing unassigned json_content variable

Medium Severity

When json.loads raises JSONDecodeError on the first TextContent item, json_content is never assigned. Line 971 then references json_content outside the try/except block, which raises a NameError at runtime. On subsequent iterations, it would instead use a stale value from a prior iteration, leading to incorrect behavior.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit de66bdb. Configure here.

for key, value in json_content.items():
if key in accept_keys:
return value

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AttributeError fix is unreachable due to uncaught exception

High Severity

The isinstance(json_content, dict) guard at line 971 is meant to prevent AttributeError when json.loads returns a non-dict, but the unguarded .items() call at line 966 still executes first inside the try block. Since the except only catches json.JSONDecodeError, any AttributeError from calling .items() on a non-dict propagates uncaught — the new guard code is never reached in the exact scenario it's trying to fix. Additionally, when json_content is a dict, lines 973–975 redundantly re-iterate the same items already checked at lines 966–968.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit de66bdb. Configure here.

return ""