security: prevent exception message disclosure in OAuth error handling#32166
security: prevent exception message disclosure in OAuth error handling#32166kolega-ai-dev wants to merge 1 commit intolanggenius:mainfrom
Conversation
Service layer exceptions containing sensitive information (database errors, connection details) were exposed to users via OAuth callback redirect URLs. Replaced dynamic exception descriptions with a generic error message.
dosubot
bot
added
the
size:XS
Summary of ChangesHello @kolega-ai-dev, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request implements a crucial security fix to prevent the disclosure of sensitive exception messages to end-users during OAuth authentication flows. By replacing dynamic error descriptions with generic messages and sanitizing the creation of Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
2 participants
Vulnerability identified and fix provided by Kolega.dev
This potential vulnerability was originally reported through Github Security Advisories on January 6th 2026, as detailed in the SECURITY.md. However, as there has been no acknowledgement or update on this, we are creating this PR in the interest of the community to assist in ensuring this project remains secure.
The finding and PR was generated using Kolega.dev's AI Agent and manually checked and verified by @FaizanKolega before PR creation.
Exception Message Disclosure in OAuth Error Handling
Location
api/controllers/console/auth/oauth.py:136Description
Exception descriptions from the service layer are directly exposed to users in OAuth callback redirects. Service layer exceptions may contain sensitive information like database errors, API details, or configuration info.
Analysis Notes
The code passes
e.descriptiondirectly to the client via URL redirect. While most AccountRegisterError descriptions are hardcoded safe strings ('Invalid email or password', '30 days unavailable'), there is a dangerous case at services/account_service.py:1350 whereraise AccountRegisterError(f"Registration failed: {e}")wraps arbitrary exceptions. If the underlying exception contains database errors, connection details, or stack trace information, this will be exposed to the user in the URL. This is a real vulnerability because: (1) The description can contain raw exception messages from unexpected errors. (2) URL parameters are logged in browser history, server logs, and may be visible to intermediaries. (3) The fix is simple: map AccountRegisterError to a generic message or use an error code lookup.Fix Applied
Replaced the dynamic
e.descriptionpassthrough in the OAuth callback redirect with a static generic error message ("Account registration failed."), matching the pattern used by other auth controllers (login.py, email_register.py) that catch AccountRegisterError without exposing its description. Also removed the f-string interpolation of arbitrary exception messages inRegisterService.register()to prevent sensitive error details from being embedded in AccountRegisterError descriptions at the source.Tests/Linters Ran
ruff checkon both changed files: All checks passedruff format --checkon both changed files: Already formattedpytest tests/unit_tests/controllers/console/auth/test_oauth.py --no-cov: 26 passedpytest tests/unit_tests/services/test_account_service.py --no-cov: 52 passedpytest tests/unit_tests/controllers/console/auth/ --no-cov: 103 passed (all auth controller tests)