From 476a4fd4200b5e3e593de5c1f8f399ef1e0eb484 Mon Sep 17 00:00:00 2001 From: Chuck <33324927+ChuckBuilds@users.noreply.github.com> Date: Tue, 15 Sep 2026 09:58:57 -0400 Subject: [PATCH] fix(auto-update): let the app-wide handler answer status-route errors CodeQL (py/stack-trace-exposure, #709) flagged the route's own except, which returned describe_exception(e). web_interface/app.py's error handler already logs the traceback and returns the same redacted detail for any unhandled exception, so the local copy is removed: same response, no new exception-to-response flow, and test_web_error_detail's policy still holds. Co-Authored-By: Claude Opus 5 --- web_interface/blueprints/api_v3/system.py | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) diff --git a/web_interface/blueprints/api_v3/system.py b/web_interface/blueprints/api_v3/system.py index bb77e208..2c5d712a 100644 --- a/web_interface/blueprints/api_v3/system.py +++ b/web_interface/blueprints/api_v3/system.py @@ -124,17 +124,15 @@ def get_system_version(): return jsonify({'status': 'error', 'message': 'Unable to retrieve version'}), 500 @api_v3.route('/system/auto-update', methods=['GET']) def get_auto_update_status(): - """Weekly automatic update status: last result, next check, and any alert.""" + """Weekly automatic update status: last result, next check, and any alert. + + No local except: a failure falls through to the app-wide handler in + web_interface/app.py, which logs the traceback and returns the redacted + detail -- the response every route gives, without a second copy here. + """ from web_interface import auto_update - try: - config = api_v3.config_manager.load_config() if api_v3.config_manager else {} - return jsonify({'status': 'success', 'data': auto_update.describe_status(config)}) - except Exception as e: - # describe_exception redacts credentials; the detail is kept on purpose - # (see test_web_error_detail.py) so a failure is diagnosable from the UI. - logger.error("get_auto_update_status failed", exc_info=True) - return jsonify({'status': 'error', 'message': 'Could not read automatic update status', - 'details': describe_exception(e)}), 500 + config = api_v3.config_manager.load_config() if api_v3.config_manager else {} + return jsonify({'status': 'success', 'data': auto_update.describe_status(config)}) @api_v3.route('/system/auto-update/dismiss', methods=['POST'])