fix(security): stabilize exception-redaction successor

.jules/sentinel.md

@@ -138,3 +138,7 @@
 **Vulnerability:** The `_safe_filename` function in `backend/services/attachment_parser.py` used `pathlib.Path().name` to strip directory components from attachment filenames, but failed to normalize backslashes beforehand. This allowed attackers to use Windows-style path separators (e.g., `..\..\upload`) to bypass path validation on POSIX systems.
 **Learning:** Checking for traversal sequences using `pathlib.Path().name` may leave the result vulnerable if the input path can contain Windows-style path separators but the program interprets it dynamically or decodes payloads using backslashes, because POSIX `pathlib` treats backslashes as valid filename characters, not separators.
 **Prevention:** Always convert backslashes to forward slashes before parsing filenames using `pathlib.Path().name`.
+## 2026-09-08 - Prevent Exception Information Leakage
+**Vulnerability:** Exception objects were string-interpolated directly into log messages (e.g., `logger.error(f"Error: {e}")`). This can leak sensitive internal information, such as API keys in request errors, full stack traces, or database credentials, into the application logs.
+**Learning:** String interpolation of exception objects may inadvertently expose sensitive data that attackers could exploit if they gain access to logs.
+**Prevention:** Use the `core.safe_logging.redacted_exception_info(e)` helper for exception logging, which securely preserves the traceback frames while discarding the exception message (which may contain API keys or secrets). Raw `exc_info=True` still prints the exception message, so it is NOT a secure redaction method. Also, do not pass exception variables (e.g., `e`) into propagated exception messages like `raise Error(f"{e}")`.

backend/api/emails.py

@@ -1,3 +1,4 @@
+from core.safe_logging import redacted_exception_info
 from collections import defaultdict
 from threading import Lock
 from fastapi import APIRouter, Depends, File, HTTPException, Query, UploadFile
@@ -773,7 +774,7 @@ async def send_email_endpoint(
     except HTTPException:
         raise
     except Exception as e:
-        logger.error(f"Error sending email: {e}", exc_info=True)
+        logger.error("Error sending email", exc_info=redacted_exception_info(e))
         raise HTTPException(
             status_code=500, detail="An internal error occurred while sending the email"
-        )
+        ) from None

backend/api/prompts.py

@@ -1,5 +1,6 @@
 import datetime
 import json
+import logging
 import re
 from typing import List, Optional
 
@@ -9,12 +10,14 @@
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from api.auth import AuthContext, get_auth_context
+from core.safe_logging import redacted_exception_info
 from db.models import LLMProvider, PromptTemplate
 from db.session import get_db
 from services.llm_provider_urls import build_llm_provider_http_client
 from services.tenant_config_scope import get_scoped_tenant_config
 
 router = APIRouter(prefix="/api/prompts", tags=["prompts"])
+logger = logging.getLogger(__name__)
 
 PROMPT_TEST_MAX_CONTENT_CHARS = 4000
 PROMPT_TEST_MAX_VARIABLES = 20
@@ -113,14 +116,12 @@ async def execute_prompt_with_llm(
         )
         content = response.choices[0].message.content
         return {"result": content if content else ""}
-    except Exception as e:
-        import logging
-
-        logging.getLogger(__name__).error(f"Prompt execution failed: {e}")
+    except Exception as exc:
+        logger.error("Prompt execution failed", exc_info=redacted_exception_info(exc))
         raise HTTPException(
             status_code=502,
             detail="Failed to execute prompt with AI provider. Check provider status.",
-        )
+        ) from None
     finally:
         await client.close()
 

backend/core/safe_logging.py

@@ -0,0 +1,21 @@
+"""Logging helpers that preserve diagnostic frames without exception messages."""
+
+from __future__ import annotations
+
+from types import TracebackType
+
+_REDACTED_EXCEPTION_MESSAGE = "Exception details redacted"
+
+
+def redacted_exception_info(
+    exc: BaseException,
+) -> tuple[type[RuntimeError], RuntimeError, TracebackType | None]:
+    """Return traceback frames paired with a generic exception value.
+
+    Standard ``exc_info=True`` includes ``str(exc)`` in formatted logs. Provider,
+    parser, database, and protocol exceptions can embed credentials or other
+    secret-derived values there. Reusing only the traceback object keeps the
+    failing call path available to operators while replacing the exception type
+    and value with a stable, non-sensitive diagnostic marker.
+    """
+    return RuntimeError, RuntimeError(_REDACTED_EXCEPTION_MESSAGE), exc.__traceback__

backend/import_fixtures.py

@@ -37,8 +37,8 @@ async def generate_fixture_embedding(text: str) -> list[float]:
 async def import_eml_file(session, eml_file: Path) -> bool:
     try:
         parsed = parse_eml(eml_file)
-    except Exception as e:
-        logger.error(f"Failed to parse {eml_file}: {e}")
+    except Exception:
+        logger.error("Fixture email parsing failed")
         return False
 
     existing = await session.execute(
@@ -55,8 +55,8 @@ async def import_eml_file(session, eml_file: Path) -> bool:
     body_text = parsed["body"] if parsed["body"].strip() else "Empty body"
     try:
         body_emb = await generate_fixture_embedding(body_text)
-    except Exception as e:
-        logger.error(f"Failed to generate embedding for {eml_file}: {e}")
+    except Exception:
+        logger.error("Fixture email body embedding failed")
         return False
 
     thread_id = await assign_thread_id(
@@ -93,15 +93,15 @@ async def import_eml_file(session, eml_file: Path) -> bool:
                     embedding=att_emb,
                 )
             )
-        except Exception as e:
-            logger.error(f"Failed to generate embedding for attachment {att['filename']}: {e}")
+        except Exception:
+            logger.error("Fixture attachment embedding failed")
 
     session.add(email_obj)
     try:
         await session.commit()
-    except Exception as e:
+    except Exception:
         await session.rollback()
-        logger.error(f"Failed to commit {eml_file}: {e}")
+        logger.error("Fixture email commit failed")
         return False
     logger.info(
         f"Imported {eml_file.name} with {len(parsed.get('attachments', []))} attachments."

backend/scripts/import_fixtures.py

@@ -11,6 +11,7 @@
 sys.path.append(str(Path(__file__).resolve().parent.parent))
 
 from services.archive import extract_backup_async
+from services.exceptions import ArchiveError
 from services.email_parser import parse_eml
 from services.embedding import (
     STORAGE_EMBEDDING_DIMENSION,
@@ -30,11 +31,21 @@
 IMPORT_ORGANIZATION_ID = os.environ.get("NARUON_IMPORT_ORGANIZATION_ID", "default")
 
 
-async def process_zip_file(zip_path: str | Path, session: AsyncSession):
+async def process_zip_file(zip_path: str | Path, session: AsyncSession) -> bool:
+    """Import one fixture archive and report whether extraction was accepted."""
     with tempfile.TemporaryDirectory() as temp_dir:
-        logger.info(f"Extracting {zip_path}...")
-        extracted_files = await extract_backup_async(zip_path, temp_dir)
-
+        logger.info("Extracting fixture archive")
+        extracted_files: list[Path] | None
+        try:
+            extracted_files = await extract_backup_async(zip_path, temp_dir)
+        except ArchiveError:
+            logger.error("Fixture archive extraction failed")
+            return False
+        except Exception:
+            extracted_files = None
+
+        if extracted_files is None:
+            raise ArchiveError("Fixture archive extraction failed")
 
         batch_values = []
         for file_path in extracted_files:
@@ -43,8 +54,8 @@ async def process_zip_file(zip_path: str | Path, session: AsyncSession):
 
             try:
                 email_data = parse_eml(file_path)
-            except Exception as e:
-                logger.error(f"Failed to parse {file_path}: {e}")
+            except Exception:
+                logger.error("Fixture archive email parsing failed")
                 continue
 
             chunks = chunk_text(email_data["body"])
@@ -70,34 +81,33 @@ async def process_zip_file(zip_path: str | Path, session: AsyncSession):
                             embeddings[0],
                             STORAGE_EMBEDDING_DIMENSION,
                         )
-                except Exception as e:
-                    logger.error(
-                        f"Failed to generate embedding for {email_data['message_id']}: {e}"
-                    )
+                except Exception:
+                    logger.error("Fixture archive email embedding failed")
 
-            # Upsert into database
             thread_id = await assign_thread_id(
                 session,
                 email_data,
                 user_id=IMPORT_USER_ID,
                 organization_id=IMPORT_ORGANIZATION_ID,
             )
 
-            batch_values.append(dict(
-                user_id=IMPORT_USER_ID,
-                organization_id=IMPORT_ORGANIZATION_ID,
-                message_id=email_data["message_id"],
-                sender=email_data["sender"],
-                reply_to=email_data.get("reply_to"),
-                recipients=email_data["recipients"],
-                subject=email_data["subject"],
-                in_reply_to=email_data.get("in_reply_to"),
-                references=email_data.get("references"),
-                thread_id=thread_id,
-                date=email_data["date"],
-                body=email_data["body"],
-                embedding=embedding,
-            ))
+            batch_values.append(
+                dict(
+                    user_id=IMPORT_USER_ID,
+                    organization_id=IMPORT_ORGANIZATION_ID,
+                    message_id=email_data["message_id"],
+                    sender=email_data["sender"],
+                    reply_to=email_data.get("reply_to"),
+                    recipients=email_data["recipients"],
+                    subject=email_data["subject"],
+                    in_reply_to=email_data.get("in_reply_to"),
+                    references=email_data.get("references"),
+                    thread_id=thread_id,
+                    date=email_data["date"],
+                    body=email_data["body"],
+                    embedding=embedding,
+                )
+            )
 
         if batch_values:
             stmt = insert(Email)
@@ -120,20 +130,22 @@ async def process_zip_file(zip_path: str | Path, session: AsyncSession):
             )
             await session.execute(stmt, batch_values)
         await session.commit()
-        logger.info(f"Finished processing {zip_path}")
+        logger.info("Finished processing fixture archive")
+        return True
 
 
 async def main():
     root_dir = Path(__file__).resolve().parent.parent.parent
     fixtures_dir = root_dir / "secret_fixtures"
 
     if not fixtures_dir.exists():
-        logger.error(f"Fixtures directory {fixtures_dir} does not exist.")
+        logger.error("Fixture directory is unavailable")
         return
 
     async with AsyncSessionLocal() as session:
         for zip_file in fixtures_dir.glob("*.zip"):
-            await process_zip_file(zip_file, session)
+            if not await process_zip_file(zip_file, session):
+                raise ArchiveError("Fixture archive extraction failed")
 
 
 if __name__ == "__main__":

backend/services/imap_worker.py

@@ -1,3 +1,4 @@
+from core.safe_logging import redacted_exception_info
 import asyncio
 import datetime
 import logging
@@ -98,6 +99,7 @@ async def process_fetched_email(
         await extract_knowledge_from_self_sent(session, new_email, owner_addresses)
     return new_email
 
+
 logger = logging.getLogger(__name__)
 MAX_IMAP_FETCH_MESSAGES = 10
 
@@ -112,7 +114,11 @@ def flags_indicate_seen(fetch_data) -> bool:
     for item in fetch_data or []:
         parts = item if isinstance(item, (tuple, list)) else (item,)
         for part in parts:
-            raw = part if isinstance(part, bytes) else str(part).encode("utf-8", "replace")
+            raw = (
+                part
+                if isinstance(part, bytes)
+                else str(part).encode("utf-8", "replace")
+            )
             upper = raw.upper()
             if b"FLAGS" in upper and b"\\SEEN" in upper:
                 return True
@@ -163,7 +169,9 @@ async def _run_loop(self):
             except asyncio.CancelledError:
                 break
             except Exception as e:
-                logger.error(f"Error in ImapSyncWorker loop: {e}", exc_info=True)
+                logger.error(
+                    "Error in ImapSyncWorker loop", exc_info=redacted_exception_info(e)
+                )
 
             # Sleep for 1 minute before the next sync
             if self._is_running:
@@ -217,7 +225,7 @@ async def _sync_tenant(self, config: TenantConfig | ImapSyncConfig):
                 config.user_id,
             )
             return 0
-        
+
         logger.info(
             "Connecting to IMAP server %s:%s for user %s",
             imap_server,
@@ -252,6 +260,7 @@ async def _fetch_messages(
         if imap_server is None or imap_port is None:
             imap_server, imap_port = self._validated_destination(config)
         import ssl
+
         ssl_context = ssl.create_default_context()
         imap_client = aioimaplib.IMAP4_SSL(
             imap_server, imap_port, ssl_context=ssl_context
@@ -388,6 +397,4 @@ def _looks_like_rfc822_message(self, value: bytes) -> bool:
         header_block = value.split(b"\r\n\r\n", maxsplit=1)[0]
         if header_block == value:
             header_block = value.split(b"\n\n", maxsplit=1)[0]
-        return b":" in header_block and (
-            b"\r\n\r\n" in value or b"\n\n" in value
-        )
+        return b":" in header_block and (b"\r\n\r\n" in value or b"\n\n" in value)