-
Notifications
You must be signed in to change notification settings - Fork 309
v5.0.0 (not automated) #1209
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
v5.0.0 (not automated) #1209
Conversation
Co-authored-by: Taichiro Suzuki <taichirs@amazon.co.jp>
Co-authored-by: Taichiro Suzuki <taichirs@amazon.co.jp>
Co-authored-by: Taichiro Suzuki <taichirs@amazon.co.jp>
LGTM, Thank you.
Co-authored-by: Yusuke Wada <52243855+wadabee@users.noreply.github.com> Co-authored-by: remote-swe-app[bot] <123456+remote-swe-app[bot]@users.noreply.github.com> Co-authored-by: Yusuke Wada <wadaysk@amazon.co.jp> Co-authored-by: sugi <sugi.mount@gmail.com> Co-authored-by: sugusugi <sugusugi@amazon.co.jp> Co-authored-by: kaye <33077429+kaye-dev@users.noreply.github.com>
Co-authored-by: Taichiro Suzuki <taichirs@amazon.co.jp>
finally: | ||
clean_ws_directory() | ||
|
||
return StreamingResponse(generate(), media_type="text/event-stream") |
Check warning
Code scanning / CodeQL
Information exposure through an exception Medium
Stack trace information
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 6 days ago
To fix this issue, we should ensure that whenever an exception is caught and reported to the end-user (in any streamed or regular response), the error message reveals no sensitive information. We should log the actual exception and stack trace on the server, but only emit a generic message in the events streamed to the user.
Specifically, in AgentManager.process_request_streaming
(in src/agent.py
), replace the event:
"message": f"An error occurred while processing your request: {str(e)}"
with:
"message": "An internal server error occurred while processing your request."
and log the exception stack trace internally for diagnosis.
You may want to use logger.exception
to record the stack trace.
Files/regions/lines to change:
- Only
src/agent.py
needs updating, specifically the exception handler inprocess_request_streaming
.
Implementation Needed:
- Update the error message as described.
- Replace the logger call to output the stacktrace (
logger.error(...)
→logger.exception(...)
).
-
Copy modified line R76 -
Copy modified line R80
@@ -73,11 +73,11 @@ | ||
yield json.dumps(event, ensure_ascii=False) + "\n" | ||
|
||
except Exception as e: | ||
logger.error(f"Error processing agent request: {e}") | ||
logger.exception("Error processing agent request") | ||
error_event = { | ||
"event": { | ||
"internalServerException": { | ||
"message": f"An error occurred while processing your request: {str(e)}", | ||
"message": "An internal server error occurred while processing your request.", | ||
} | ||
} | ||
} |
except Exception as e: | ||
logger.error(f"Error processing request: {e}") | ||
logger.error(traceback.format_exc()) | ||
return create_error_response(str(e)) |
Check warning
Code scanning / CodeQL
Information exposure through an exception Medium
Stack trace information
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 6 days ago
To fix this problem, error messages sent to the user should be generic and not include details directly derived from the exception, while the full details and stack trace can still be logged on the server for investigative purposes. Specifically, in app.py
, replace create_error_response(str(e))
with something like create_error_response("An internal error has occurred while processing your request.")
. Leave the extensive info in logs as in the current logger statements.
Only app.py
requires editing: specifically, the except Exception as e:
block in the /invocations
endpoint where the response to the client is constructed.
No additional imports or helper functions are needed because a generic string can be used directly.
-
Copy modified line R88
@@ -85,7 +85,7 @@ | ||
except Exception as e: | ||
logger.error(f"Error processing request: {e}") | ||
logger.error(traceback.format_exc()) | ||
return create_error_response(str(e)) | ||
return create_error_response("An internal error has occurred while processing your request.") | ||
finally: | ||
clean_ws_directory() | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Release!
Description of Changes
Checklist
npm run cdk:test
and if there are snapshot differences, executenpm run cdk:test:update-snapshot
to update snapshotsRelated Issues