langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-22 04:25:29 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

When the Tool within the Agent uses the secret-input type parameter and is automatically replaced with "***", it will cause the API request to fail. #4686

New Issue
Closed
opened 2026-02-21 18:07:33 -05:00 by yindo · 2 comments
yindo commented 2026-02-21 18:07:33 -05:00
Owner
Copy Link
Copy Source

Originally created by @coldstone on GitHub (Jul 19, 2024).

Originally assigned to: @takatost, @Yeuoly on GitHub.

Self Checks

  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report (我已阅读并同意 Language Policy).
  • 请务必使用英文提交 Issue，否则会被关闭。谢谢！:）
  • Please do not modify this template :) and fill in all the required fields.

Dify version

0.6.14

Cloud or Self Hosted

Self Hosted (Source)

Steps to reproduce

The parameter type in Tool is secret-input:
image

Add this tool in Agnet and fill in the parameters manually:
image

Start the test conversation:
image

✔️ Expected Behavior

Sometimes, parameters are sent normally during API requests and the results are correct :
image

❌ Actual Behavior

Sometimes, parameters will be replaced with ****, and the requests received by the server are also masked parameters, and the request results are incorrect:
image

This situation does not occur inevitably, and no occasional pattern can be found. It just happened! Moreover, when it occurred, even if I immediately re-filled these parameters and saved them, when requesting again, the parameters were still replaced with ****.

By the way, My Dify has pulled the latest version of the code (0.6.14-2024/07/19, f2004ad)

Originally created by @coldstone on GitHub (Jul 19, 2024). Originally assigned to: @takatost, @Yeuoly on GitHub. ### Self Checks - [X] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [X] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [X] I confirm that I am using English to submit this report (我已阅读并同意 [Language Policy](https://github.com/langgenius/dify/issues/1542)). - [X] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:） - [X] Please do not modify this template :) and fill in all the required fields. ### Dify version 0.6.14 ### Cloud or Self Hosted Self Hosted (Source) ### Steps to reproduce The parameter type in Tool is `secret-input`: ![image](https://github.com/user-attachments/assets/d81b07f9-23e0-4f0d-869c-a8d8f5f0f731) Add this tool in Agnet and fill in the parameters manually: ![image](https://github.com/user-attachments/assets/ca7fc925-c311-49d6-b33b-9b8e2cc03d7b) Start the test conversation: ![image](https://github.com/user-attachments/assets/0e373b0f-cc0b-43eb-a070-08da7b2d1b95) ### ✔️ Expected Behavior Sometimes, parameters are sent normally during API requests and the results are correct : ![image](https://github.com/user-attachments/assets/74e4a434-fe1c-408e-9094-812b1f652a3c) ### ❌ Actual Behavior Sometimes, parameters will be replaced with ****, and the requests received by the server are also masked parameters, and the request results are incorrect: ![image](https://github.com/user-attachments/assets/a7634b42-5a6a-4fbe-8b95-6da4f30a6d69) This situation does not occur inevitably, and no occasional pattern can be found. It just happened! Moreover, when it occurred, even if I immediately re-filled these parameters and saved them, when requesting again, the parameters were still replaced with ****. By the way, My Dify has pulled the latest version of the code (0.6.14-2024/07/19, [f2004ad](https://github.com/langgenius/dify/pull/6257/commits/f2004ad89f4a9bb0e90acaf0a1c2e3091bf9bca7))
yindo added the 🐞 bug label 2026-02-21 18:07:33 -05:00
yindo closed this issue 2026-02-21 18:07:34 -05:00
yindo commented 2026-02-21 18:07:34 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Jul 19, 2024):

To resolve the issue where secret-input type parameters are sporadically replaced with "***" in API requests in Dify version 0.6.14, ensure that the parameters are properly decrypted before being used in the API requests. The decrypt_tool_parameters method should be called to decrypt the parameters before they are used. Here is the relevant part of the code that handles decryption:

def decrypt_tool_parameters(self, parameters: dict[str, Any]) -> dict[str, Any]:
    """
    decrypt tool parameters with tenant id

    return a deep copy of parameters with decrypted values
    """
    cache = ToolParameterCache(
        tenant_id=self.tenant_id,
        provider=f'{self.provider_type}.{self.provider_name}',
        tool_name=self.tool_runtime.identity.name,
        cache_type=ToolParameterCacheType.PARAMETER,
        identity_id=self.identity_id
    )
    cached_parameters = cache.get()
    if cached_parameters:
        return cached_parameters

    # override parameters
    current_parameters = self._merge_parameters()
    has_secret_input = False

    for parameter in current_parameters:
        if parameter.form == ToolParameter.ToolParameterForm.FORM and parameter.type == ToolParameter.ToolParameterType.SECRET_INPUT:
            if parameter.name in parameters:
                try:
                    has_secret_input = True
                    parameters[parameter.name] = encrypter.decrypt_token(self.tenant_id, parameters[parameter.name])
                except:
                    pass

    if has_secret_input:
        cache.set(parameters)

    return parameters

Ensure that this method is invoked at the appropriate place in your code where the parameters are being prepared for the API request. This will ensure that the secret-input type parameters are decrypted and not replaced with "***" [1].

Additionally, specific logs or error messages are generated when the secret-input parameters are replaced with "***" in the API requests. The API response will include the action field set to "overrided" and the inputs or text fields will show the replaced content [2][3].

To continue talking to Dosu, mention @dosu.

@dosubot[bot] commented on GitHub (Jul 19, 2024): <!-- Answer --> To resolve the issue where `secret-input` type parameters are sporadically replaced with "***" in API requests in Dify version 0.6.14, ensure that the parameters are properly decrypted before being used in the API requests. The `decrypt_tool_parameters` method should be called to decrypt the parameters before they are used. Here is the relevant part of the code that handles decryption: ```python def decrypt_tool_parameters(self, parameters: dict[str, Any]) -> dict[str, Any]: """ decrypt tool parameters with tenant id return a deep copy of parameters with decrypted values """ cache = ToolParameterCache( tenant_id=self.tenant_id, provider=f'{self.provider_type}.{self.provider_name}', tool_name=self.tool_runtime.identity.name, cache_type=ToolParameterCacheType.PARAMETER, identity_id=self.identity_id ) cached_parameters = cache.get() if cached_parameters: return cached_parameters # override parameters current_parameters = self._merge_parameters() has_secret_input = False for parameter in current_parameters: if parameter.form == ToolParameter.ToolParameterForm.FORM and parameter.type == ToolParameter.ToolParameterType.SECRET_INPUT: if parameter.name in parameters: try: has_secret_input = True parameters[parameter.name] = encrypter.decrypt_token(self.tenant_id, parameters[parameter.name]) except: pass if has_secret_input: cache.set(parameters) return parameters ``` Ensure that this method is invoked at the appropriate place in your code where the parameters are being prepared for the API request. This will ensure that the `secret-input` type parameters are decrypted and not replaced with "***" <sup>[[1]](https://github.com/langgenius/dify/blob/main/api/core/tools/utils/configuration.py)</sup>. Additionally, specific logs or error messages are generated when the `secret-input` parameters are replaced with "***" in the API requests. The API response will include the `action` field set to "overrided" and the `inputs` or `text` fields will show the replaced content <sup>[[2]](https://github.com/langgenius/dify-docs/blob/main/en/guides/extension/api-based-extension/moderation-extension.md)</sup><sup>[[3]](https://github.com/langgenius/dify-docs/blob/main/en/guides/extension/api-based-extension/moderation.md)</sup>. <!-- Dosu Comment Footer --> *To continue talking to [Dosu](https://dosu.dev), mention @dosu.*
yindo commented 2026-02-21 18:07:34 -05:00
Author
Owner
Copy Link
Copy Source

@crazywoola commented on GitHub (Jul 19, 2024):

@takatost @Yeuoly

@crazywoola commented on GitHub (Jul 19, 2024): @takatost @Yeuoly
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label 🐞 bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#4686
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?