From f40e6f31275f5a6b36f481a26746a25233060f2f Mon Sep 17 00:00:00 2001 From: Chuck Date: Mon, 29 Jun 2026 12:11:07 -0400 Subject: [PATCH] fix(tools-tab): don't expose filesystem paths in OSError messages CodeQL flagged str(exc) flowing into the JSON response for the install_plugin_requirements action. Use exc.strerror instead, which gives the OS error description ("No such file or directory", "Permission denied") without the internal filesystem path. Co-Authored-By: Claude Sonnet 4.6 --- web_interface/blueprints/api_v3.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/web_interface/blueprints/api_v3.py b/web_interface/blueprints/api_v3.py index 2f59d3b8..dba3d1c8 100644 --- a/web_interface/blueprints/api_v3.py +++ b/web_interface/blueprints/api_v3.py @@ -1701,7 +1701,7 @@ def execute_system_action(): except subprocess.TimeoutExpired: results.append({'plugin': p.name, 'ok': False, 'output': 'pip install timed out'}) except OSError as exc: - results.append({'plugin': p.name, 'ok': False, 'output': str(exc)}) + results.append({'plugin': p.name, 'ok': False, 'output': exc.strerror or 'OS error'}) ok_count = sum(1 for r in results if r['ok']) all_ok = all(r['ok'] for r in results) if results else True return jsonify({