a2aproject / a2aproject/a2a-python

[Bug]: Internal error messages leak into responses

未关闭
#1,232 0 条评论 0 个 reaction 已指派 1 人 已被 @rohityan 认领 在 GitHub 查看
component: server
主要语言
Python
星标
2.1k
派生
496
平均合并
4 天 17 小时
30 天内合并 PR
12

描述

### What happened?

When a server raises an exception, such as when supplying a context ID that is > 36 chars, the client receives a JSON RPC error object which includes the full internal error message that the server produced.

This is not good security practice to leak internal error messages like this, and could expose sensitive information.

A suggestion would be to redact any internal error messages, and perhaps create a mapping of common errors to client friendly error messages.

If the intention is for implementations to handle this themselves, with patching or intercepting, which is likely what we will be doing, it should be at least documented.

### Relevant log output

```shell
Actual response received:

{'error': {'code': -32603, 'message': '(sqlalchemy.dialects.postgresql.asyncpg.Error) : value too long for type character varying(36)\n[SQL: INSERT INTO tasks (id, context_id, kind, owner, last_updated, status, artifacts, history, protocol_version, metadata) VALUES ($1::VARCHAR, $2::VARCHAR, $3::VARCHAR, $4::VARCHAR, $5::TIMESTAMP WITHOUT TIME ZONE, $6::JSON, $7::JSON, $8::JSON, $9::VARCHAR, $10::JSON)]\n[parameters: (\'2deb8a1b-a091-4388-a7c2-832e579f6ba6\', \'21198763-5774-4cfd-a1da-883d915260ee999999999\', \'task\', \'\', None, \'{"state": "TASK_STATE_SUBMITTED"}\', \'[]\', \'[{"messageId": "e0f25133-9dcf-4cb9-9c32-e1cd63e3eee0", "contextId": "21198763-5774-4cfd-a1da-883d915260ee999999999", "taskId": "2deb8a1b-a091-4388-a7c2-832e579f6ba6", "role": "ROLE_USER", "parts": [{"text": "How\\\'s the weather in London?"}]}]\', \'1.0\', \'null\')]\n(Background on this error at: https://sqlalche.me/e/20/dbapi)'}, 'id': '19783034-a4f6-4a3f-b772-b004eb4b5cc7', 'jsonrpc': '2.0'}

Suggested response:

{'error': {'code': -32603, 'message': 'Context ID too long, must be <=36 chars.'}, 'id': '19783034-a4f6-4a3f-b772-b004eb4b5cc7', 'jsonrpc': '2.0'}

Or:

{'error': {'code': -32603, 'message': 'Server Error'}, 'id': '19783034-a4f6-4a3f-b772-b004eb4b5cc7', 'jsonrpc': '2.0'}
```

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。