langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-21 03:55:25 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

[PR #32166] security: prevent exception message disclosure in OAuth error handling #33587

New Issue
Open
opened 2026-02-21 20:53:33 -05:00 by yindo · 0 comments
yindo commented 2026-02-21 20:53:33 -05:00
Owner
Copy Link
Copy Source

Original Pull Request: https://github.com/langgenius/dify/pull/32166

State: open
Merged: No

Vulnerability identified and fix provided by Kolega.dev

This potential vulnerability was originally reported through Github Security Advisories on January 6th 2026, as detailed in the SECURITY.md. However, as there has been no acknowledgement or update on this, we are creating this PR in the interest of the community to assist in ensuring this project remains secure.

The finding and PR was generated using Kolega.dev's AI Agent and manually checked and verified by @FaizanKolega before PR creation.

Exception Message Disclosure in OAuth Error Handling

Location

api/controllers/console/auth/oauth.py:136

Description

Exception descriptions from the service layer are directly exposed to users in OAuth callback redirects. Service layer exceptions may contain sensitive information like database errors, API details, or configuration info.

Analysis Notes

The code passes e.description directly to the client via URL redirect. While most AccountRegisterError descriptions are hardcoded safe strings ('Invalid email or password', '30 days unavailable'), there is a dangerous case at services/account_service.py:1350 where raise AccountRegisterError(f"Registration failed: {e}") wraps arbitrary exceptions. If the underlying exception contains database errors, connection details, or stack trace information, this will be exposed to the user in the URL. This is a real vulnerability because: (1) The description can contain raw exception messages from unexpected errors. (2) URL parameters are logged in browser history, server logs, and may be visible to intermediaries. (3) The fix is simple: map AccountRegisterError to a generic message or use an error code lookup.

Fix Applied

Replaced the dynamic e.description passthrough in the OAuth callback redirect with a static generic error message ("Account registration failed."), matching the pattern used by other auth controllers (login.py, email_register.py) that catch AccountRegisterError without exposing its description. Also removed the f-string interpolation of arbitrary exception messages in RegisterService.register() to prevent sensitive error details from being embedded in AccountRegisterError descriptions at the source.

Tests/Linters Ran

  • ruff check on both changed files: All checks passed
  • ruff format --check on both changed files: Already formatted
  • pytest tests/unit_tests/controllers/console/auth/test_oauth.py --no-cov: 26 passed
  • pytest tests/unit_tests/services/test_account_service.py --no-cov: 52 passed
  • pytest tests/unit_tests/controllers/console/auth/ --no-cov: 103 passed (all auth controller tests)
**Original Pull Request:** https://github.com/langgenius/dify/pull/32166 **State:** open **Merged:** No --- *Vulnerability identified and fix provided by [Kolega.dev](https://kolega.dev/)* This potential vulnerability was originally reported through Github Security Advisories on January 6th 2026, as detailed in the SECURITY.md. However, as there has been no acknowledgement or update on this, we are creating this PR in the interest of the community to assist in ensuring this project remains secure. The finding and PR was generated using [Kolega.dev](https://kolega.dev/)'s AI Agent and manually checked and verified by @FaizanKolega before PR creation. ## Exception Message Disclosure in OAuth Error Handling ## Location `api/controllers/console/auth/oauth.py:136` ## Description Exception descriptions from the service layer are directly exposed to users in OAuth callback redirects. Service layer exceptions may contain sensitive information like database errors, API details, or configuration info. ## Analysis Notes The code passes `e.description` directly to the client via URL redirect. While most AccountRegisterError descriptions are hardcoded safe strings ('Invalid email or password', '30 days unavailable'), there is a dangerous case at services/account_service.py:1350 where `raise AccountRegisterError(f"Registration failed: {e}")` wraps arbitrary exceptions. If the underlying exception contains database errors, connection details, or stack trace information, this will be exposed to the user in the URL. This is a real vulnerability because: (1) The description can contain raw exception messages from unexpected errors. (2) URL parameters are logged in browser history, server logs, and may be visible to intermediaries. (3) The fix is simple: map AccountRegisterError to a generic message or use an error code lookup. ## Fix Applied Replaced the dynamic `e.description` passthrough in the OAuth callback redirect with a static generic error message ("Account registration failed."), matching the pattern used by other auth controllers (login.py, email_register.py) that catch AccountRegisterError without exposing its description. Also removed the f-string interpolation of arbitrary exception messages in `RegisterService.register()` to prevent sensitive error details from being embedded in AccountRegisterError descriptions at the source. ## Tests/Linters Ran - `ruff check` on both changed files: All checks passed - `ruff format --check` on both changed files: Already formatted - `pytest tests/unit_tests/controllers/console/auth/test_oauth.py --no-cov`: 26 passed - `pytest tests/unit_tests/services/test_account_service.py --no-cov`: 52 passed - `pytest tests/unit_tests/controllers/console/auth/ --no-cov`: 103 passed (all auth controller tests)
yindo added the pull-request label 2026-02-21 20:53:33 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#33587
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?