reject empty base64 image inputs

codex-rs/codex-api/src/api_bridge.rs

@@ -57,8 +57,8 @@ pub fn map_api_error(err: ApiError) -> CodexErr {
                 }
 
                 if status == http::StatusCode::BAD_REQUEST {
-                    if let Ok(parsed) = serde_json::from_str::<Value>(&body_text)
-                        && let Some(error) = parsed.get("error")
+                    let parsed = serde_json::from_str::<Value>(&body_text).ok();
+                    if let Some(error) = parsed.as_ref().and_then(|parsed| parsed.get("error"))
                         && error.get("code").and_then(Value::as_str)
                             == Some(CYBER_POLICY_ERROR_CODE)
                     {
@@ -69,8 +69,8 @@ pub fn map_api_error(err: ApiError) -> CodexErr {
                             .map(str::to_string)
                             .unwrap_or_else(|| CYBER_POLICY_FALLBACK_MESSAGE.to_string());
                         CodexErr::CyberPolicy { message }
-                    } else if body_text
-                        .contains("The image data you provided does not represent a valid image")
+                    } else if body_text.contains(IMAGE_PARSE_ERROR)
+                        || body_text.contains(IMAGE_INVALID_BASE64)
                     {
                         CodexErr::InvalidImageRequest()
                     } else {
@@ -145,6 +145,8 @@ const X_ERROR_JSON_HEADER: &str = "x-error-json";
 const CYBER_POLICY_ERROR_CODE: &str = "cyber_policy";
 const CYBER_POLICY_FALLBACK_MESSAGE: &str =
     "This request has been flagged for possible cybersecurity risk.";
+const IMAGE_PARSE_ERROR: &str = "The image data you provided does not represent a valid image";
+const IMAGE_INVALID_BASE64: &str = "Expected a base64-encoded data URL with an image MIME type";
 
 #[cfg(test)]
 #[path = "api_bridge_tests.rs"]

codex-rs/codex-api/src/api_bridge_tests.rs

@@ -124,6 +124,48 @@ fn map_api_error_keeps_unknown_400_errors_generic() {
     assert_eq!(message, body);
 }
 
+#[test]
+fn map_api_error_maps_empty_base64_image_error_message() {
+    const EMPTY_IMAGE_MESSAGE: &str = "Expected a base64-encoded data URL with an image MIME type \
+        (e.g. 'data:image/png;base64,aW1nIGJ5dGVzIGhlcmU='), but got empty base64-encoded bytes.";
+
+    let cases = [
+        ("input[0].content[2].image_url", EMPTY_IMAGE_MESSAGE, true),
+        ("input[111].output[1].image_url", EMPTY_IMAGE_MESSAGE, true),
+        ("input[0].name", "Expected a valid tool name.", false),
+    ];
+
+    for (param, message, maps_to_invalid_image) in cases {
+        let body = serde_json::json!({
+            "error": {
+                "type": "invalid_request_error",
+                "code": "invalid_value",
+                "message": format!("Invalid '{param}'. {message}"),
+                "param": param
+            }
+        })
+        .to_string();
+        let err = map_api_error(ApiError::Transport(TransportError::Http {
+            status: http::StatusCode::BAD_REQUEST,
+            url: Some("http://example.com/v1/responses".to_string()),
+            headers: None,
+            body: Some(body.clone()),
+        }));
+
+        if maps_to_invalid_image {
+            assert!(
+                matches!(err, CodexErr::InvalidImageRequest()),
+                "expected InvalidImageRequest for {param}, got {err:?}"
+            );
+        } else {
+            let CodexErr::InvalidRequest(message) = err else {
+                panic!("expected CodexErr::InvalidRequest for {param}, got {err:?}");
+            };
+            assert_eq!(message, body);
+        }
+    }
+}
+
 #[test]
 fn map_api_error_maps_usage_limit_limit_name_header() {
     let mut headers = HeaderMap::new();