github-featured / learningcircuit--local-deep-research

发布

0 发布 174 Git 标签

RSS 订阅源
  • v1.8.0 fb1d8f9c39
    比较

    fix(security): don't leak URL-parse exception in notification test error (CodeQL #4775) (#4835)

    frostbyte_neo 发布于 2026-06-27 22:37:44 +00:00

    • fix(security): stop echoing URL-parse exception in notification test error (CodeQL #4775)

    NotificationURLValidator.validate_service_url embedded the raw urlparse
    exception into its returned error string (f"Invalid URL format: {e}"). Since
    #4002 (test-URL endpoint), that validator string is surfaced to the caller, so
    the exception text flowed into the /api/notifications/test-url HTTP response —
    CodeQL py/stack-trace-exposure (CWE-209), alert #4775.

    Return a generic "Invalid URL format" message and log the exception with a full
    traceback via logger.exception so debugging detail stays server-side. This
    mirrors the existing safe pattern at the LocationParseError handler a few
    lines below.

    No test asserted the old exception-bearing message; notification validator,
    SSRF validator, and notification service suites (419 tests) pass.

    • test(security): regression test that URL-parse exception is not leaked

    Patches urlparse to raise with a sensitive marker and asserts the validator
    returns the generic "Invalid URL format" message without the marker, covering
    the CodeQL #4775 stack-trace-exposure fix.

    下载附件