dotCMS / dotCMS/core

dotAI: Stop returning Java stack traces from AI viewtool exceptions

Open
#37,154 2 comments 0 reactions 1 assignee View on GitHub

@hassandotcms is already working on this.

Since Sep 8, 2026.

dotCMS : Security Team : Modernization Type : Task
Dominant language
Java
Stars
970
Forks
486
Avg merge
3d 33m
Merged PRs (30d)
170

Description

Note: Part of the dotAI security review. Small hardening.

Description

CompletionsTool.handleException returns the full Java stack trace to the caller/template, unconditionally:

return Map.of("error", e.getMessage(), "stackTrace", out.toString());

There is no dev/prod gate — the trace is always built and returned whenever the viewtool throws. If a template renders that object, internal implementation details (class names, paths, stack frames) are exposed to end users (information disclosure).

Scope note: this issue covers only the stack-trace return. The separate debug logging of full prompt/response bodies (AppConfig.debugLogger) is gated behind an explicit, default-off flag (DEBUG_LOGGING / AI_DEBUG_LOGGING) and is considered working-as-intended troubleshooting behavior — out of scope here.

Affected code
  • com.dotcms.ai.viewtool.CompletionsTool#handleException(Exception).

Acceptance Criteria

  • The viewtool returns a generic, safe error message to the caller/template (no stack trace, no internal paths/class names).
  • Full exception detail is logged server-side via Logger for diagnostics.
  • Any other dotAI viewtool exception handlers that surface stack traces are updated the same way.
  • Unit test: a thrown exception yields a generic error payload with no stack trace, and the detail is logged.

Priority

Low

Additional Context

Trivial change (~half a day). The debug-logging behavior is intentionally left as-is.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.