From e3a023f8f9b4494b3d5d8115bcafa54eb9a51889 Mon Sep 17 00:00:00 2001 From: ionfwsrijan Date: Fri, 10 Jul 2026 08:17:11 +0530 Subject: [PATCH] fix: sanitize parser sandbox error messages to prevent sensitive data leaks (#1626) --- backend/secuscan/executor.py | 2 +- backend/secuscan/parser_sandbox.py | 10 ++++++---- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/backend/secuscan/executor.py b/backend/secuscan/executor.py index a8523a245..eb6cae0ec 100644 --- a/backend/secuscan/executor.py +++ b/backend/secuscan/executor.py @@ -1702,7 +1702,7 @@ def _parse_results(self, plugin, output: str) -> Dict[str, Any]: except Exception as exc: logger.error("Unexpected error running parser sandbox for '%s': %s", plugin.id, exc) raise RuntimeError( - f"Custom parser encountered an unexpected error for plugin '{plugin.id}'" + f"Custom parser encountered an unexpected error for plugin '{plugin.id}': {redact(str(exc))}" ) from exc # 2. Fallback to legacy built-in parsers (only reached when no parser.py exists) diff --git a/backend/secuscan/parser_sandbox.py b/backend/secuscan/parser_sandbox.py index 7d7c4d0d0..15677097b 100644 --- a/backend/secuscan/parser_sandbox.py +++ b/backend/secuscan/parser_sandbox.py @@ -51,6 +51,8 @@ from pathlib import Path from typing import Any, Dict +from .redaction import redact + logger = logging.getLogger(__name__) # Defaults — overridden by the Settings values passed at call time. @@ -84,11 +86,11 @@ class ParserSandboxError(RuntimeError): def __init__(self, plugin_id: str, reason: str, stderr: str = "") -> None: self.plugin_id = plugin_id self.reason = reason - # Keep stderr private; callers must not surface this to API consumers. + sanitized = redact(stderr[:2000]) if stderr else "" self._stderr_diagnostic: str = stderr - self.stderr_excerpt = stderr[:2000] if stderr else "" - # User-facing message: reason only — no stderr content. - super().__init__(f"Parser sandbox failed for '{plugin_id}' ({reason})") + self.stderr_excerpt = sanitized + detail = f": {sanitized[:200]}" if sanitized.strip() else "" + super().__init__(f"Parser sandbox failed for '{plugin_id}' ({reason}){detail}") # ---------------------------------------------------------------------------