dotAI: Stop returning Java stack traces from AI viewtool exceptions
@hassandotcms is already working on this.
Since Sep 8, 2026.
- Dominant language
- Java
- Stars
- 970
- Forks
- 486
- Avg merge
- 3d 33m
- Merged PRs (30d)
- 170
Description
Note: Part of the dotAI security review. Small hardening.
Description
CompletionsTool.handleException returns the full Java stack trace to the caller/template, unconditionally:
return Map.of("error", e.getMessage(), "stackTrace", out.toString());
There is no dev/prod gate — the trace is always built and returned whenever the viewtool throws. If a template renders that object, internal implementation details (class names, paths, stack frames) are exposed to end users (information disclosure).
Scope note: this issue covers only the stack-trace return. The separate debug logging of full prompt/response bodies (AppConfig.debugLogger) is gated behind an explicit, default-off flag (DEBUG_LOGGING / AI_DEBUG_LOGGING) and is considered working-as-intended troubleshooting behavior — out of scope here.
Affected code
com.dotcms.ai.viewtool.CompletionsTool#handleException(Exception).
Acceptance Criteria
- The viewtool returns a generic, safe error message to the caller/template (no stack trace, no internal paths/class names).
- Full exception detail is logged server-side via
Loggerfor diagnostics. - Any other dotAI viewtool exception handlers that surface stack traces are updated the same way.
- Unit test: a thrown exception yields a generic error payload with no stack trace, and the detail is logged.
Priority
Low
Additional Context
Trivial change (~half a day). The debug-logging behavior is intentionally left as-is.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.