Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| ) + MESSAGE_DELIMITER | ||
|
|
||
| return Response(stream_with_context(generate()), content_type="application/json") | ||
| return StreamingResponse(generate(), media_type="application/json") |
Check warning
Code scanning / CodeQL
Information exposure through an exception Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 1 year ago
To fix the problem, we need to ensure that any error messages returned from the loader (specifically, those from MySQLLoader.load and MySQLLoader.refresh_graph_schema) are not sent directly to the user if they may contain sensitive information. Instead, we should log the detailed error message on the server and return a generic error message to the user.
The main region to change is in api/routes/graphs.py, inside the generate() function, where the result of loader_class.refresh_graph_schema(graph_id, db_url) is handled. If refresh_success is False, we should log refresh_message and return a generic error message in the response.
No changes are needed in api/loaders/mysql_loader.py unless you want to further sanitize error messages at the source, but the main exposure is in the API response.
Required changes:
- In
api/routes/graphs.py, inside thegenerate()function, update the block that handles schema refresh failures to log the detailed error and return a generic message to the user. - Ensure logging is done using the existing
loggingmodule.
| @@ -464,8 +464,9 @@ | ||
| } | ||
| ) + MESSAGE_DELIMITER | ||
| else: | ||
| failure_msg = (f"⚠️ Schema was modified but graph " | ||
| f"refresh failed: {refresh_message}") | ||
| # Log the detailed error message server-side | ||
| logging.error("Graph schema refresh failed: %s", str(refresh_message)) | ||
| failure_msg = ("⚠️ Schema was modified but graph refresh failed due to an internal error. Please contact support or try again later.") | ||
| yield json.dumps( | ||
| { | ||
| "type": "schema_refresh", |
| ) + MESSAGE_DELIMITER | ||
|
|
||
| return Response(stream_with_context(generate_confirmation()), content_type="application/json") | ||
| return StreamingResponse(generate_confirmation(), media_type="application/json") |
Check warning
Code scanning / CodeQL
Information exposure through an exception Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 1 year ago
To fix the problem, we need to ensure that any error messages returned from the loader (specifically, refresh_message from loader_class.refresh_graph_schema) are not sent directly to the user if the operation fails. Instead, we should log the detailed error message on the server and return a generic error message in the API response. This change should be made in api/routes/graphs.py, in the confirm_destructive_operation function, specifically in the generator function generate_confirmation, where the schema refresh failure message is yielded to the user. The fix involves replacing the use of refresh_message in the response with a generic message, while logging the actual error for debugging purposes.
| @@ -573,11 +573,11 @@ | ||
| } | ||
| ) + MESSAGE_DELIMITER | ||
| else: | ||
| logging.error("Schema was modified but graph refresh failed: %s", refresh_message) | ||
| yield json.dumps( | ||
| { | ||
| "type": "schema_refresh", | ||
| "message": (f"⚠️ Schema was modified but graph refresh failed: " | ||
| f"{refresh_message}"), | ||
| "message": "⚠️ Schema was modified but graph refresh failed due to an internal error.", | ||
| "refresh_status": "failed" | ||
| } | ||
| ) + MESSAGE_DELIMITER |
- Bump litellm ~=1.82.0 → ~=1.83.0 (fixes CVE: auth bypass via OIDC cache key collision, privilege escalation via unrestricted proxy config) - Bump fastmcp >=2.13.1 → >=3.2.0 (fixes CVE: SSRF & path traversal in OpenAPI provider) - Add aiohttp>=3.13.4 constraint (fixes multiple HTTP-level CVEs: duplicate Host headers, header injection, multipart bypass, memory DoS, CRLF injection, cookie leaks, SSRF on Windows) - Add npm override for lodash-es to 4.18.1 (fixes prototype pollution via array path bypass, code injection via template imports) - Update fastmcp import path from deprecated fastmcp.server.openapi to fastmcp.server.providers.openapi Closes #125, #124, #123, #122, #121, #120, #119, #118, #117, #116, #115, #114, #113, #112, #111, #110, #109, #108, #107, #106, #105, #104, #103, #102, #101, #100, #99, #98, #97, #96 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Bump litellm ~=1.82.0 → ~=1.83.0 (fixes CVE: auth bypass via OIDC cache key collision, privilege escalation via unrestricted proxy config) - Bump fastmcp >=2.13.1 → >=3.2.0 (fixes CVE: SSRF & path traversal in OpenAPI provider) - Add aiohttp>=3.13.4 constraint (fixes multiple HTTP-level CVEs: duplicate Host headers, header injection, multipart bypass, memory DoS, CRLF injection, cookie leaks, SSRF on Windows) - Add npm override for lodash-es to 4.18.1 (fixes prototype pollution via array path bypass, code injection via template imports) - Update fastmcp import path from deprecated fastmcp.server.openapi to fastmcp.server.providers.openapi Closes #125, #124, #123, #122, #121, #120, #119, #118, #117, #116, #115, #114, #113, #112, #111, #110, #109, #108, #107, #106, #105, #104, #103, #102, #101, #100, #99, #98, #97, #96 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: galshubeli <124919062+galshubeli@users.noreply.github.com> Co-authored-by: gkorland <753206+gkorland@users.noreply.github.com>
3 participants
No description provided.