a2aproject / a2aproject/a2a-python

[Bug]: Internal error messages leak into responses

未關閉
#1,232 0 則留言 0 個 reaction 已指派 1 人 已被 @rohityan 認領 在 GitHub 檢視
component: server
主要語言
Python
星號
2.1k
分支
496
平均合併
4 天 17 小時
30 天內合併 PR
12

描述

### What happened?

When a server raises an exception, such as when supplying a context ID that is > 36 chars, the client receives a JSON RPC error object which includes the full internal error message that the server produced.

This is not good security practice to leak internal error messages like this, and could expose sensitive information.

A suggestion would be to redact any internal error messages, and perhaps create a mapping of common errors to client friendly error messages.

If the intention is for implementations to handle this themselves, with patching or intercepting, which is likely what we will be doing, it should be at least documented.

### Relevant log output

```shell
Actual response received:

{'error': {'code': -32603, 'message': '(sqlalchemy.dialects.postgresql.asyncpg.Error) : value too long for type character varying(36)\n[SQL: INSERT INTO tasks (id, context_id, kind, owner, last_updated, status, artifacts, history, protocol_version, metadata) VALUES ($1::VARCHAR, $2::VARCHAR, $3::VARCHAR, $4::VARCHAR, $5::TIMESTAMP WITHOUT TIME ZONE, $6::JSON, $7::JSON, $8::JSON, $9::VARCHAR, $10::JSON)]\n[parameters: (\'2deb8a1b-a091-4388-a7c2-832e579f6ba6\', \'21198763-5774-4cfd-a1da-883d915260ee999999999\', \'task\', \'\', None, \'{"state": "TASK_STATE_SUBMITTED"}\', \'[]\', \'[{"messageId": "e0f25133-9dcf-4cb9-9c32-e1cd63e3eee0", "contextId": "21198763-5774-4cfd-a1da-883d915260ee999999999", "taskId": "2deb8a1b-a091-4388-a7c2-832e579f6ba6", "role": "ROLE_USER", "parts": [{"text": "How\\\'s the weather in London?"}]}]\', \'1.0\', \'null\')]\n(Background on this error at: https://sqlalche.me/e/20/dbapi)'}, 'id': '19783034-a4f6-4a3f-b772-b004eb4b5cc7', 'jsonrpc': '2.0'}

Suggested response:

{'error': {'code': -32603, 'message': 'Context ID too long, must be <=36 chars.'}, 'id': '19783034-a4f6-4a3f-b772-b004eb4b5cc7', 'jsonrpc': '2.0'}

Or:

{'error': {'code': -32603, 'message': 'Server Error'}, 'id': '19783034-a4f6-4a3f-b772-b004eb4b5cc7', 'jsonrpc': '2.0'}
```

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

貢獻指南

開啟貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。