fix: replace raw exception strings in HTTP responses (CWE-209)

[Copilot]

Raw str(exc) / str(e) values were being stored in state objects that get serialised and returned to HTTP clients, leaking internal implementation details (file paths, class names, internal logic) via GET /api/user-scanner/full-scan/status and the unauthenticated GET /api/settings endpoint.

Changes

• simple_org_chart/app_main.py — three call sites replaced with generic error strings:
  • _background_full_scan: scan state dict error field
  • trigger_update: mark_data_update_finished error arg
  • clear_cached_data: mark_data_update_finished error arg

# Before
st['error'] = str(exc)
mark_data_update_finished(success=False, error=str(e), source='manual')

# After
st['error'] = 'An internal error occurred during the scan.'
mark_data_update_finished(success=False, error='An internal error occurred.', source='manual')

Server-side logger.error(...) calls are preserved in all three locations, so full exception details remain available to operators in logs.

[Copilot]

Pull request overview

This PR aims to mitigate CWE-209 (information exposure) by replacing raw exception strings previously stored in server-side state objects that are serialized back to HTTP clients (notably via /api/user-scanner/full-scan/status and the unauthenticated /api/settings GET).

Changes:

• Sanitize the background full-scan state’s error field with a generic message.
• Sanitize mark_data_update_finished(..., error=...) calls to avoid persisting raw exception strings into the data update status surfaced by /api/settings.
• Preserve server-side logging at the failure sites (operators can still diagnose issues from logs).

Suppressed comments (2)

simple_org_chart/app_main.py:3791

• Now that the client-facing scan error is intentionally generic, the logs become the primary place to diagnose failures. logger.error('Background full scan failed: %s', exc) does not record a traceback; using logger.exception(...) (or exc_info=True) will preserve full exception context for operators.

            logger.error('Background full scan failed: %s', exc)
            with _full_scan_lock:
                st = _read_scan_state()
                st['running'] = False
                st['error'] = 'An internal error occurred during the scan.'

simple_org_chart/app_main.py:4105

• logger.error(f"Error triggering update after clearing data: {e}") drops the traceback, which makes diagnosing failures harder (especially now that the stored/returned error is generic). Prefer logger.exception(...) here to capture the stack trace.

        logger.error(f"Error triggering update after clearing data: {e}")
        mark_data_update_finished(success=False, error='An internal error occurred.', source='manual')

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.