Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| res.end(JSON.stringify({ | ||
| jsonrpc: '2.0', | ||
| error: { code: -32000, message: errorMessage }, | ||
| id: null, | ||
| })); |
Check warning
Code scanning / CodeQL
Information exposure through a stack trace Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 2 months ago
In general, to fix this kind of issue you should avoid sending raw exception messages or stack traces to the client. Instead, log detailed error information on the server (including the original error/stack) and send back a generic, stable error message and possibly a coarse error code. This preserves observability for developers while preventing attackers from learning about internal structure.
For this specific file, we should keep the existing logging behavior (or expand it slightly) but change the HTTP response so it no longer includes errorMessage derived from the thrown error. Instead, return a constant, non‑sensitive message such as "Internal server error" or a localized equivalent, and keep the JSON-RPC error.code unchanged to avoid breaking clients. Optionally, we can log the full error object (including stack) with console.error, but that must not be reflected in the response.
Concretely:
- In
ecosystem/semi-mcp/src/http.ts, within thecatch (error)block around lines 140–149:- Keep computing
errorMessagefor logging purposes only. - Keep (or slightly enhance) the server‑side
console.errorcall. - Change the JSON response body so that
error.messageis a fixed generic string (e.g.,'Internal server error') instead oferrorMessage.
- Keep computing
- No new imports are required; we can use
console.erroras already present. - No new functions or types are strictly needed; this is a minimal behavior-preserving change for clients except that they no longer receive internal error text.
| @@ -139,12 +139,16 @@ | ||
| console.log(`[${new Date().toISOString()}] ${req.method} ${url.pathname} - ${res.statusCode}`); | ||
| } catch (error) { | ||
| const errorMessage = error instanceof Error ? error.message : String(error); | ||
| console.error(`[${new Date().toISOString()}] 请求处理错误:`, errorMessage); | ||
| // 仅在服务器端日志中记录详细错误信息，避免向客户端暴露内部细节 | ||
| console.error( | ||
| `[${new Date().toISOString()}] 请求处理错误:`, | ||
| errorMessage | ||
| ); | ||
| if (!res.headersSent) { | ||
| res.writeHead(500, { 'Content-Type': 'application/json' }); | ||
| res.end(JSON.stringify({ | ||
| jsonrpc: '2.0', | ||
| error: { code: -32000, message: errorMessage }, | ||
| error: { code: -32000, message: 'Internal server error' }, | ||
| id: null, | ||
| })); | ||
| } |
1 participant
中文模板 / Chinese Template
What kind of change does this PR introduce? (check at least one)
PR description
Fixes #
Changelog
🇨🇳 Chinese
get_semi_document获取组件文档或组件列表get_component_file_list获取组件文件列表get_file_code获取文件代码get_function_code获取函数实现🇺🇸 English
get_semi_documentGet component documentation or component listget_component_file_listGet component file listget_file_codeGet file codeget_function_codeGet function implementationChecklist
Other
Additional information