Skip to content

Potential fix for code scanning alert no. 1: Information exposure through an exception - #289

Open
Exohayvan wants to merge 1 commit into
mainfrom
alert-autofix-1
Open

Potential fix for code scanning alert no. 1: Information exposure through an exception#289
Exohayvan wants to merge 1 commit into
mainfrom
alert-autofix-1

Conversation

@Exohayvan

Copy link
Copy Markdown
Contributor

Potential fix for https://github.com/AetherMesh-AI/aethermesh-core/security/code-scanning/1

The best fix is to stop returning str(exc) in the submission response and replace it with a stable, generic message, while logging the exception server-side for diagnostics.

Concretely, in src/aethermesh_core/runtime_service.py within submit_local_job_status (around lines 864–872), update the except RuntimeServiceError as exc block to:

  • log the exception with logger.exception(...) (or equivalent),
  • return _submission_status(...) with a non-sensitive static message such as "Local submission request is invalid.".

This preserves existing functionality (request still returns a structured rejected status) but removes information exposure.
To implement this, runtime_service.py needs a module logger:

  • add import logging with existing imports,
  • define logger = logging.getLogger(__name__) near constants/import region.

No API signature changes are required.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

…ough an exception

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@Exohayvan
Exohayvan marked this pull request as ready for review July 23, 2026 02:07
@Exohayvan Exohayvan added type:bug Type: bug or broken behavior. priority:P2 Priority P2: high-impact near-term work. system:api System: HTTP/API surface. system:runtime System: local node runtime/service lifecycle. area:local-api Area: generated triage label for local api. area:api-response Area: API response schemas or route payloads. risk:medium Risk: changes existing working behavior with moderate regression risk. needs:review Needs: generated triage label for review. labels Jul 23, 2026
@Exohayvan Exohayvan added status:blocked Human-readable workflow status: blocked by a failing gate or dependency. and removed needs:review Needs: generated triage label for review. labels Jul 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area:api-response Area: API response schemas or route payloads. area:local-api Area: generated triage label for local api. priority:P2 Priority P2: high-impact near-term work. risk:medium Risk: changes existing working behavior with moderate regression risk. status:blocked Human-readable workflow status: blocked by a failing gate or dependency. system:api System: HTTP/API surface. system:runtime System: local node runtime/service lifecycle. type:bug Type: bug or broken behavior.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant