BUG: [error-handling] Incomplete traceback in `wrap_unexpected` may leak sensitive data #2817

New issue

Open

opened 2026-04-04 20:39:11 +00:00 by freemo · 0 comments

freemo commented

2026-04-04 20:39:11 +00:00

Owner

Metadata

Branch: fix/error-handling-wrap-unexpected-traceback
Commit Message: fix(error-handling): make traceback line count configurable in wrap_unexpected
Milestone: v3.3.0
Parent Epic: #362

Bug Report

Severity Assessment

Impact: Potential for sensitive information leakage in logs.
Likelihood: Low, as it requires an attacker to have access to the logs.
Priority: Low

Location

File: src/cleveragents/core/error_handling.py
Function/Class: wrap_unexpected
Lines: 301–303

Description

The wrap_unexpected function in src/cleveragents/core/error_handling.py only includes the last 3 lines of the traceback in the error details. This is a hardcoded constant with no configurability. While the intent is to limit exposure, this approach has two problems:

Sensitive data may still appear in the last 3 lines — the redaction via redact_value is applied, but the selection of which lines to include is arbitrary and not driven by a security policy.
Debugging is impaired — developers cannot access the full traceback even in debug/development environments, making diagnosis of unexpected errors unnecessarily difficult.

Evidence

# Build sanitised details for diagnostics.
tb_lines = traceback.format_exception(type(exc), exc, exc.__traceback__)
tb_text = "".join(tb_lines[-3:])  # last 3 lines only
tb_text = redact_value(tb_text)

Expected Behavior

The number of traceback lines included in the error details should be configurable (e.g., via a setting or debug flag), allowing full tracebacks in development/debug mode while restricting output in production. Alternatively, the full traceback should be redacted before truncation so that sensitive data is never included regardless of line count.

Actual Behavior

Only the last 3 lines of the traceback are included, hardcoded with no mechanism to override this in any environment.

Suggested Fix

Introduce a configurable max_tb_lines parameter (or read from settings) in wrap_unexpected.
Apply redact_value to the full traceback text before any truncation, then truncate if needed.
Provide a debug flag or environment variable (e.g., CLEVERAGENTS_DEBUG_TRACEBACKS=1) that enables full traceback output in non-production environments.

Subtasks

Write a failing Behave scenario that reproduces the hardcoded 3-line truncation behaviour (TDD — merge to master before fix)
Refactor wrap_unexpected to apply redact_value to the full traceback before truncation
Make the traceback line limit configurable (settings key or debug env var)
Update type annotations and docstrings for wrap_unexpected
Verify all nox stages pass (nox -e lint, nox -e typecheck, nox -e unit_tests, nox -e integration_tests, nox -e coverage_report)

Definition of Done

A failing Behave test reproducing the bug is merged to master before the fix PR is opened
wrap_unexpected applies redact_value to the full traceback prior to any line-count truncation
The traceback line limit is configurable and documented
No # type: ignore suppressions introduced
All nox stages pass
Coverage >= 97%
PR linked to this issue and this issue linked to parent Epic #362

Automated by CleverAgents Bot
Supervisor: Bug Hunting | Agent: ca-new-issue-creator

## Metadata - **Branch**: `fix/error-handling-wrap-unexpected-traceback` - **Commit Message**: `fix(error-handling): make traceback line count configurable in wrap_unexpected` - **Milestone**: v3.3.0 - **Parent Epic**: #362 ## Bug Report ### Severity Assessment - **Impact**: Potential for sensitive information leakage in logs. - **Likelihood**: Low, as it requires an attacker to have access to the logs. - **Priority**: Low ### Location - **File**: `src/cleveragents/core/error_handling.py` - **Function/Class**: `wrap_unexpected` - **Lines**: 301–303 ### Description The `wrap_unexpected` function in `src/cleveragents/core/error_handling.py` only includes the last 3 lines of the traceback in the error details. This is a hardcoded constant with no configurability. While the intent is to limit exposure, this approach has two problems: 1. **Sensitive data may still appear in the last 3 lines** — the redaction via `redact_value` is applied, but the selection of which lines to include is arbitrary and not driven by a security policy. 2. **Debugging is impaired** — developers cannot access the full traceback even in debug/development environments, making diagnosis of unexpected errors unnecessarily difficult. ### Evidence ```python # Build sanitised details for diagnostics. tb_lines = traceback.format_exception(type(exc), exc, exc.__traceback__) tb_text = "".join(tb_lines[-3:]) # last 3 lines only tb_text = redact_value(tb_text) ``` ### Expected Behavior The number of traceback lines included in the error details should be configurable (e.g., via a setting or debug flag), allowing full tracebacks in development/debug mode while restricting output in production. Alternatively, the full traceback should be redacted before truncation so that sensitive data is never included regardless of line count. ### Actual Behavior Only the last 3 lines of the traceback are included, hardcoded with no mechanism to override this in any environment. ### Suggested Fix 1. Introduce a configurable `max_tb_lines` parameter (or read from settings) in `wrap_unexpected`. 2. Apply `redact_value` to the **full** traceback text before any truncation, then truncate if needed. 3. Provide a debug flag or environment variable (e.g., `CLEVERAGENTS_DEBUG_TRACEBACKS=1`) that enables full traceback output in non-production environments. ## Subtasks - [ ] Write a failing Behave scenario that reproduces the hardcoded 3-line truncation behaviour (TDD — merge to `master` before fix) - [ ] Refactor `wrap_unexpected` to apply `redact_value` to the full traceback before truncation - [ ] Make the traceback line limit configurable (settings key or debug env var) - [ ] Update type annotations and docstrings for `wrap_unexpected` - [ ] Verify all nox stages pass (`nox -e lint`, `nox -e typecheck`, `nox -e unit_tests`, `nox -e integration_tests`, `nox -e coverage_report`) ## Definition of Done - [ ] A failing Behave test reproducing the bug is merged to `master` before the fix PR is opened - [ ] `wrap_unexpected` applies `redact_value` to the full traceback prior to any line-count truncation - [ ] The traceback line limit is configurable and documented - [ ] No `# type: ignore` suppressions introduced - [ ] All nox stages pass - [ ] Coverage >= 97% - [ ] PR linked to this issue and this issue linked to parent Epic #362 --- **Automated by CleverAgents Bot** Supervisor: Bug Hunting | Agent: ca-new-issue-creator

freemo added this to the v3.3.0 milestone

2026-04-04 20:39:15 +00:00

freemo added a new dependency

2026-04-04 20:39:23 +00:00

#362 Epic: Security & Safety Hardening

freemo added the

MoSCoW

Could have

label

2026-04-04 20:41:06 +00:00

freemo referenced this issue

2026-04-04 20:41:23 +00:00