Pull in updates from master #248
Conversation
Advanced Param Dependencies Video
Added an image to the blueprint
Updated the relevent files to match the json file
azure and aws patching XUIs
Oparlak samples
Update AWS AMI ID for AMI and OSBAttribute objects
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| except Exception as e: | ||
| logger.exception("Failed to create CMP group") | ||
| return JsonResponse({"error": str(e)}, status=500) |
Check warning
Code scanning / CodeQL
Information exposure through an exception Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 2 days ago
In general, to fix this type of issue you should avoid returning raw exception messages or stack traces to the client. Instead, log the full exception details on the server and send a generic, non-sensitive error message in the HTTP response. Optionally, you can include a generic error code or correlation ID if the client needs something to report back to support.
Concretely in this file, only the create_cmp_group view’s except block is problematic. The exception is already logged with logger.exception("Failed to create CMP group"), so developers still have full diagnostic information. We should change the JsonResponse to return a fixed, generic error message rather than str(e). The rest of the functionality (success path, status codes, request method handling) remains unchanged. No new imports or helpers are needed.
Specifically:
- In
ui_extensions/azure_ad_group_import/views.py, around line 116–118, replace:return JsonResponse({"error": str(e)}, status=500)
- With:
- a generic message, for example
return JsonResponse({"error": "Failed to create CMP group"}, status=500)
- a generic message, for example
This keeps behavior (a 500 with an error field) but removes the exposure of the underlying exception details.
| @@ -115,6 +115,6 @@ | ||
|
|
||
| except Exception as e: | ||
| logger.exception("Failed to create CMP group") | ||
| return JsonResponse({"error": str(e)}, status=500) | ||
| return JsonResponse({"error": "Failed to create CMP group"}, status=500) | ||
|
|
||
| return JsonResponse({"error": "Invalid method"}, status=405) |
Development Prerequisites
Summary of Proposed Changes