-
Notifications
You must be signed in to change notification settings - Fork 28
Staging #362
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Co-authored-by: pierre.delaunay <[email protected]>
|
|
4c928a8
to
4fd868c
Compare
* ignore tensorflow-probability * Pin Dependencies --------- Co-authored-by: pierre.delaunay <[email protected]>
|
|
return { | ||
"status": "offline", | ||
"reason": result["stderr"] | ||
} |
Check warning
Code scanning / CodeQL
Information exposure through an exception Medium
Stack trace information
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 12 days ago
To fix the information exposure issue, ensure that exception details (such as those from str(e)
) are not sent back to the client in HTTP responses. Instead, return a generic error message, and log the full details (stack trace and exception message) only on the server side. This change should be applied in all relevant exception handlers, especially those that formulate API responses with details from caught exceptions. Specifically, edit remote_command()
to return a generic "Internal error occurred" message in its 'stderr'
field in the event of an unexpected exception, while still printing/logging exception details server-side. No changes to functionality or API structure are required; only the error message needs to be sanitized.
-
Copy modified line R418 -
Copy modified line R422
@@ -415,10 +415,11 @@ | ||
except Exception as e: | ||
import traceback | ||
traceback.print_exc() | ||
# Do not expose internal error details to the client | ||
return { | ||
'success': False, | ||
'stdout': '', | ||
'stderr': str(e), | ||
'stderr': 'Internal error occurred', | ||
'returncode': -1 | ||
} | ||
|
No description provided.