FIX: Sanitize externally visible API errors#2237
Open
hannahwestra25 wants to merge 6 commits into
Open
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2040f373-2101-4e34-a067-70c15ac7211e
Distinguish public registry validation from constructor failures, sanitize error outcome reasons, and retain blocked-content messages. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2040f373-2101-4e34-a067-70c15ac7211e
romanlutz
reviewed
Jul 20, 2026
|
|
||
| logger = logging.getLogger(__name__) | ||
|
|
||
| _ATTACK_ERROR_MESSAGE = "Attack execution failed. Check server logs for details." |
Contributor
There was a problem hiding this comment.
But users can't see the server logs. I think we've been going the opposite direction so far because people want to know what went wrong. Of course, that's not an argument to not hide secrets.
Contributor
Author
There was a problem hiding this comment.
good call, removed the "check server logs" bit. the 1CS policy (“Applications MUST NOT expose sensitive application data to end-users through error messages,” and cryptographic errors reported remotely “must be reported only in generic terms.”) requires this but also as a follow up item we could have more structured error categories to give a little bit more of an actionable error
Update frontend expectations for generic runtime and server errors and apply Ruff formatting required by pre-commit. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2040f373-2101-4e34-a067-70c15ac7211e
Resolve target identity validation using canonical hashes while preserving a client-safe mismatch response. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2040f373-2101-4e34-a067-70c15ac7211e
Keep public failure messages generic without directing users to operator-only logs. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2040f373-2101-4e34-a067-70c15ac7211e
Assert the generic client-safe 500 response instead of raw backend details. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2040f373-2101-4e34-a067-70c15ac7211e
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Backend and runtime exceptions can contain credentials, internal paths, provider details, and private endpoints. This change replaces unexpected diagnostics in API and rendered UI responses with stable public messages while retaining detailed server-side logging.
Safe validation now uses
ClientRequestErrorinstead of broadValueError, preserving actionable 4xx messages without exposing constructor or SDK failures. Public blocked-content messages remain visible. Error outcome reasons, retry diagnostics, and nested endpoint fields are sanitized only in external projections; persisted diagnostic data is unchanged.Tests and Documentation
Added focused backend and frontend leakage regressions for secrets, internal paths, provider details, blocked responses, and safe validation errors. Ran targeted pytest suites, Ruff, Jest, TypeScript type-check, and ESLint. Documentation changes were not applicable.