WIP: agentic devtool - #128
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| function writeJson(res: ServerResponse, statusCode: number, payload: CdpProxyResponse | { error: string }) { | ||
| res.statusCode = statusCode; | ||
| res.setHeader('content-type', 'application/json'); | ||
| res.end(JSON.stringify(payload)); |
Check warning
Code scanning / CodeQL
Information exposure through a stack trace Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 5 months ago
In general, the fix is to avoid returning raw exception information (including error messages that may contain stack details) to the client. Instead, log the detailed error server-side and return a generic, non-sensitive message in the HTTP response. This applies especially inside catch blocks where unexpected internal errors are handled.
Concretely for this file, we should modify the catch (error) block around lines 348–352 to:
- Log the full error (including stack) to the server logs, without sending it to the client.
- Return a generic error message in the JSON response, such as
"Internal server error."or a similarly non-revealing description. - Keep the existing status code (502) and the overall response shape (
{ ok: false, error: ... }) intact, so clients do not break.
We do not need to modify writeJson itself; it can continue to stringify whatever payload it is passed. The only required code change is to replace:
error: error instanceof Error ? error.message : String(error)with a constant, generic error string, and add a server-side log line in the catch block (e.g., console.error('CDP proxy invocation failed:', error);). No new imports are necessary because console is globally available in Node.js/TypeScript. All edits occur within plugins/codex-agent/main/index.ts in the shown snippet.
| @@ -346,9 +346,11 @@ | ||
| error: 'Renderer returned an invalid CDP proxy response.' | ||
| }); | ||
| } catch (error) { | ||
| // Log detailed error information server-side without exposing it to the client. | ||
| console.error('CDP proxy invocation failed:', error); | ||
| writeJson(res, 502, { | ||
| ok: false, | ||
| error: error instanceof Error ? error.message : String(error) | ||
| error: 'Internal server error.' | ||
| }); | ||
| } | ||
| }); |
2 participants
No description provided.