Add arguments support for the reset action in REST API #1948
Conversation
Signed-off-by: tdruez <tdruez@aboutcode.org>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| ) | ||
| except RunInProgressError as error: | ||
| return Response(error, status=status.HTTP_400_BAD_REQUEST) | ||
| return Response({"status": str(error)}, status=status.HTTP_400_BAD_REQUEST) |
Check warning
Code scanning / CodeQL
Information exposure through an exception Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 24 hours ago
To resolve the problem, we need to ensure that the details from the exception are not directly returned to the user. Instead, we should show a generic error message for users while logging the full exception message and stack trace on the server, if needed, for debugging. In scanpipe/api/views.py, within the archive view's except RunInProgressError as error: block (line 426-427), replace the exposure of str(error) to the response with a generic message such as "Cannot archive project while a run is in progress.", and log the error for developers. This may require importing Python's builtin logging module and configuring a logger for the current file.
The required changes:
- Add a logger import and initialize a logger.
- In the exception handler at line 427, replace the response content with a generic message (no exception details visible to the user).
- Log the exception, ideally including the stack trace, so developers still have full details.
| @@ -28,6 +28,7 @@ | ||
| from django.db.models import Q | ||
| from django.http import FileResponse | ||
|
|
||
| import logging | ||
| import django_filters | ||
| from rest_framework import mixins | ||
| from rest_framework import renderers | ||
| @@ -424,7 +425,11 @@ | ||
| remove_output=request.data.get("remove_output"), | ||
| ) | ||
| except RunInProgressError as error: | ||
| return Response({"status": str(error)}, status=status.HTTP_400_BAD_REQUEST) | ||
| logger.warning("Run in progress error when archiving project %r: %s", project, error, exc_info=True) | ||
| return Response( | ||
| {"status": "Cannot archive project while a run is in progress."}, | ||
| status=status.HTTP_400_BAD_REQUEST | ||
| ) | ||
| else: | ||
| return Response({"status": f"The project {project} has been archived."}) | ||
|
|
| ) | ||
| except RunInProgressError as error: | ||
| return Response(error, status=status.HTTP_400_BAD_REQUEST) | ||
| return Response({"status": str(error)}, status=status.HTTP_400_BAD_REQUEST) |
Check warning
Code scanning / CodeQL
Information exposure through an exception Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 24 hours ago
The correct fix is to replace the direct exposure of str(error) with a generic error message that communicates the error without sharing internal details. Logging the exception message and/or stack trace on the server is advisable for debugging, but the client should only receive an innocuous error statement.
Edits needed:
- In
scanpipe/api/views.py, update the response in the except block of theresetview method so it no longer passes through error details to the client. - Optionally, add server-side logging for the actual error to retain debuggability (using Python’s
loggingmodule). - If logging is added, add an import for
loggingat the top of the file (if not already present in the shown snippet).
| @@ -443,7 +443,13 @@ | ||
| execute_now=request.data.get("execute_now", False), | ||
| ) | ||
| except RunInProgressError as error: | ||
| return Response({"status": str(error)}, status=status.HTTP_400_BAD_REQUEST) | ||
| # Optionally log the error for internal debugging. | ||
| import logging | ||
| logging.error(f"Project reset error: {error}") | ||
| return Response( | ||
| {"status": "The project could not be reset due to an internal error."}, | ||
| status=status.HTTP_400_BAD_REQUEST | ||
| ) | ||
| else: | ||
| message = f"The {project} project has been reset." | ||
| return Response({"status": message}) |
Signed-off-by: tdruez <tdruez@aboutcode.org>
No description provided.