Sabo/webui
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: stop leaking stack traces to clients in HTTP 500 responses

Browse Source 
Tracebacks exposed file paths, module names, and potentially secret
values from local variables. Now logged server-side only; clients
receive a generic error message.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Nathan Esquenazi
2026-04-03 06:41:32 -07:00
parent 3f9d1da0e2
commit 1b1cd124f6
4 changed files with 42 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
api/streaming.py
View File

@@ -189,7 +189,8 @@ def _run_agent_streaming(session_id, msg_text, model, workspace, stream_id, atta
else: os.environ['HERMES_SESSION_KEY'] = old_session_key
except Exception as e:
put('error', {'message': str(e), 'trace': traceback.format_exc()})
print('[webui] stream error:\n' + traceback.format_exc(), flush=True)
put('error', {'message': str(e)})
finally:
_clear_thread_env() # TD1: always clear thread-local context
with STREAMS_LOCK: