feat: start v0.5 foundations#22
Conversation
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| effective_body, | ||
| ) = await _resolve_image_route_preview(body, headers) | ||
| except HookExecutionError as exc: | ||
| return JSONResponse({"error": str(exc), "type": "request_hook_error"}, status_code=500) |
Check warning
Code scanning / CodeQL
Information exposure through an exception Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 months ago
In general, the fix is to avoid returning raw exception messages to the client. Instead, log the detailed error (including stack trace) on the server and return a generic, non-sensitive message plus a stable error type/code to the client. This preserves debuggability while preventing information exposure.
Concretely for foundrygate/main.py:
- In the
image_generationsendpoint, update theexcept HookExecutionError as exc:handler. - Before returning, log the exception with
logger.exception(...)(which records the stack trace) orlogger.error(..., exc_info=True). - Change the JSON response to use a generic message like
"Request hook execution failed"instead ofstr(exc). Keep the"type": "request_hook_error"field so existing clients that key off the type are unaffected. - No new imports are needed;
loggeris already defined.
Only the lines inside that except HookExecutionError block (around 580–583) need to change.
| @@ -578,7 +578,11 @@ | ||
| effective_body, | ||
| ) = await _resolve_image_route_preview(body, headers) | ||
| except HookExecutionError as exc: | ||
| return JSONResponse({"error": str(exc), "type": "request_hook_error"}, status_code=500) | ||
| logger.exception("Request hook execution failed") | ||
| return JSONResponse( | ||
| {"error": "Request hook execution failed", "type": "request_hook_error"}, | ||
| status_code=500, | ||
| ) | ||
| except ValueError as exc: | ||
| return JSONResponse({"error": str(exc), "type": "invalid_request_error"}, status_code=400) | ||
|
|
| except HookExecutionError as exc: | ||
| return JSONResponse({"error": str(exc), "type": "request_hook_error"}, status_code=500) | ||
| except ValueError as exc: | ||
| return JSONResponse({"error": str(exc), "type": "invalid_request_error"}, status_code=400) |
Check warning
Code scanning / CodeQL
Information exposure through an exception Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 months ago
In general, to fix information exposure via exceptions, avoid returning raw exception messages or stack traces to clients. Instead, log detailed information on the server and respond with a generic, user-safe error message and optionally a stable error code. This preserves debuggability while preventing attackers from learning about internal state or implementation details.
For this specific case in foundrygate/main.py, we should change the except ValueError as exc: block in the image_generations endpoint so it no longer includes str(exc) in the JSON returned to the client. The safest approach without changing external behavior too much is:
- Log the exception (including its message and/or stack trace) using the existing
logger. - Return a generic message like
"Invalid request"(or similar) along with the existing"type": "invalid_request_error"field, so clients can still programmatically detect the error type.
Concretely:
- In
foundrygate/main.py, locate theexcept ValueError as exc:block around line 582. - Add a logging call, for example
logger.warning("Invalid image generation request: %s", exc)(orlogger.exceptionif stack trace logging is desired). - Replace the JSON body so that it uses a fixed string (e.g.,
"Invalid request") instead ofstr(exc).
No additional imports are required because logger is already defined at the top of the file via logging.getLogger("foundrygate").
| @@ -580,7 +580,8 @@ | ||
| except HookExecutionError as exc: | ||
| return JSONResponse({"error": str(exc), "type": "request_hook_error"}, status_code=500) | ||
| except ValueError as exc: | ||
| return JSONResponse({"error": str(exc), "type": "invalid_request_error"}, status_code=400) | ||
| logger.warning("Invalid image generation request: %s", exc) | ||
| return JSONResponse({"error": "Invalid request", "type": "invalid_request_error"}, status_code=400) | ||
|
|
||
| prompt = effective_body["prompt"].strip() | ||
| image_fields = _collect_image_request_fields(effective_body) |
2 participants
No description provided.