thumbor / libthumbor / 39156455976

100%

push

github

Send InvalidParameter's message attribute instead of str(error)

CodeQL flagged py/stack-trace-exposure on the 400 response in generate_url
because its body was str() of the caught exception. Every InvalidParameter
is raised with a fixed message that names at most a parameter from the
allow-list, so no stack trace or client input reached the response, but the
body depended on the exception's string form. InvalidParameter now stores
the client-facing text in a message attribute, the view sends that, and the
docstring records that it must never include the submitted value.

The response bodies are unchanged and the existing tests that assert them
still pass. Running CodeQL 2.27.2 locally with the python-code-scanning
suite reproduces the alert before this change and reports nothing after it.

4 of 4 new or added lines in 1 file covered. (100.0%)

312 of 312 relevant lines covered (100.0%)

5.0 hits per line