rick/LEDMatrix
1
0
Fork 0
mirror of https://github.com/ChuckBuilds/LEDMatrix.git synced 2026-08-02 17:28:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(tools-tab): don't expose filesystem paths in OSError messages

Browse Source 
CodeQL flagged str(exc) flowing into the JSON response for the
install_plugin_requirements action. Use exc.strerror instead, which
gives the OS error description ("No such file or directory",
"Permission denied") without the internal filesystem path.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Chuck
2026-06-29 12:11:07 -04:00
co-authored by Claude Sonnet 4.6
parent 453d46563f
commit f40e6f3127
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
web_interface/blueprints/api_v3.py
+1 -1
View File
@@ -1701,7 +1701,7 @@ def execute_system_action():
except subprocess.TimeoutExpired: except subprocess.TimeoutExpired:
results.append({'plugin': p.name, 'ok': False, 'output': 'pip install timed out'}) results.append({'plugin': p.name, 'ok': False, 'output': 'pip install timed out'})
except OSError as exc: except OSError as exc:
results.append({'plugin': p.name, 'ok': False, 'output': str(exc)}) results.append({'plugin': p.name, 'ok': False, 'output': exc.strerror or 'OS error'})
ok_count = sum(1 for r in results if r['ok']) ok_count = sum(1 for r in results if r['ok'])
all_ok = all(r['ok'] for r in results) if results else True all_ok = all(r['ok'] for r in results) if results else True
return jsonify({ return jsonify({