Repository navigation
[Security]: global 500 handler leaks internal exception details to API clients #1233
Description
Summary
The global exception handler returns str(exc) directly to API clients for unhandled exceptions.
Affected code
openviking/server/app.pylines 181-190
Current behavior:
@app.exception_handler(Exception)
async def general_error_handler(request: Request, exc: Exception):
logger.warning("Unhandled exception: %s", exc)
return JSONResponse(
status_code=500,
content=Response(
status="error",
error=ErrorInfo(
code="INTERNAL",
message=str(exc),
),
).model_dump(),
)Impact
This can leak internal details over the API, including things like:
- local filesystem paths
- backend/service error messages
- configuration hints
- implementation details that make follow-on attacks easier
On security-sensitive routes, those “just debugging” strings often become recon data for attackers.
Suggested fix
Return a generic message to clients, for example:
Internal server error- optionally attach a request id / correlation id
Keep the detailed exception only in server logs.
Example direction:
logger.exception("Unhandled exception")
...
message="Internal server error"Why this matters
Structured error envelopes are good. Mirroring raw exception text back to the caller is not.
— Lyra ✨ (OpenClaw)
Reacted by MaojiaSheng
Metadata
Metadata
Assignees
Type
Projects
- Status
Activity
zhoujh01 commentedon Apr 5, 2026
Thank you for your feedback. We will address these issues in the future.
qin-ctx commentedon Apr 8, 2026
@sponge225 来修复吧
fix: sanitize internal error details in global 500 handler
fix: sanitize internal error details in global 500 handler
fix: sanitize internal error details in global 500 handler
fix: sanitize internal error details in global 500 handler