BUG: [security] Sensitive data may leak into logs via `wrap_unexpected` exception message #4153

New issue

Open

opened 2026-04-06 11:50:06 +00:00 by freemo · 0 comments

freemo commented

2026-04-06 11:50:06 +00:00

Owner

Metadata

Branch: fix/security-wrap-unexpected-no-error-log-message
Commit Message: fix(error_handling): avoid logging raw exception message at ERROR level in wrap_unexpected
Milestone: (none — backlog, see note below)
Parent Epic: #400

Backlog note: This issue was discovered during autonomous operation
on milestone v3.6.0. It does not block milestone completion and has been
placed in the backlog for human review and future milestone assignment.

Background and Context

The wrap_unexpected function in src/cleveragents/core/error_handling.py (lines 311–315) catches arbitrary exceptions and wraps them in a CleverAgentsError. As part of this process it logs the original exception message at the ERROR level after passing it through redact_value:

logger.error(
    "Wrapping unexpected exception: %s: %s",
    type(exc).__name__,
    redact_value(str(exc)),
)

redact_value is only as effective as the set of regular-expression patterns registered with it. If a third-party library or custom code raises an exception whose message contains sensitive data (API keys, PII, file paths, bearer tokens, etc.) that does not match any registered pattern, that data will be written to the log in clear text.

This violates the fail-safe design principle: the current implementation assumes the redaction list is exhaustive, which can never be guaranteed.

Suggested Fix

Replace the ERROR-level log that includes the exception message with a generic message that contains only the exception type. Move the detailed (potentially sensitive) content to a DEBUG-level log, which is disabled by default in production:

logger.error(
    "Wrapping unexpected exception of type %s. See debug logs for details.",
    type(exc).__name__,
)
logger.debug(
    "Unexpected exception details: %s",
    redact_value(str(exc)),
    exc_info=True,
)

Subtasks

Update wrap_unexpected in src/cleveragents/core/error_handling.py to log only the exception type at ERROR level
Add DEBUG-level log with redact_value(str(exc)) and exc_info=True for diagnostic detail
Tests (Behave): Add/update scenarios in features/ to assert that the ERROR log does not contain the exception message body
Tests (Behave): Add scenario asserting the DEBUG log does contain the (redacted) exception message when debug logging is enabled
Verify coverage ≥ 97% via nox -s coverage_report
Run nox (all default sessions), fix any errors

Definition of Done

All subtasks above are checked
The ERROR-level log in wrap_unexpected contains only the exception type — no message content
The DEBUG-level log contains the redacted exception message and is gated behind the debug log level
Commit created with exact message: fix(error_handling): avoid logging raw exception message at ERROR level in wrap_unexpected
Commit pushed to branch fix/security-wrap-unexpected-no-error-log-message
Pull Request opened, reviewed (≥ 2 approvals), and merged
All nox stages pass
Coverage ≥ 97%

Automated by CleverAgents Bot
Supervisor: Bug Hunting | Agent: ca-new-issue-creator

## Metadata - **Branch**: `fix/security-wrap-unexpected-no-error-log-message` - **Commit Message**: `fix(error_handling): avoid logging raw exception message at ERROR level in wrap_unexpected` - **Milestone**: *(none — backlog, see note below)* - **Parent Epic**: #400 > **Backlog note:** This issue was discovered during autonomous operation > on milestone v3.6.0. It does not block milestone completion and has been > placed in the backlog for human review and future milestone assignment. ## Background and Context The `wrap_unexpected` function in `src/cleveragents/core/error_handling.py` (lines 311–315) catches arbitrary exceptions and wraps them in a `CleverAgentsError`. As part of this process it logs the original exception message at the `ERROR` level after passing it through `redact_value`: ```python logger.error( "Wrapping unexpected exception: %s: %s", type(exc).__name__, redact_value(str(exc)), ) ``` `redact_value` is only as effective as the set of regular-expression patterns registered with it. If a third-party library or custom code raises an exception whose message contains sensitive data (API keys, PII, file paths, bearer tokens, etc.) that does not match any registered pattern, that data will be written to the log in clear text. This violates the **fail-safe** design principle: the current implementation assumes the redaction list is exhaustive, which can never be guaranteed. ## Suggested Fix Replace the `ERROR`-level log that includes the exception message with a generic message that contains only the exception type. Move the detailed (potentially sensitive) content to a `DEBUG`-level log, which is disabled by default in production: ```python logger.error( "Wrapping unexpected exception of type %s. See debug logs for details.", type(exc).__name__, ) logger.debug( "Unexpected exception details: %s", redact_value(str(exc)), exc_info=True, ) ``` ## Subtasks - [ ] Update `wrap_unexpected` in `src/cleveragents/core/error_handling.py` to log only the exception type at `ERROR` level - [ ] Add `DEBUG`-level log with `redact_value(str(exc))` and `exc_info=True` for diagnostic detail - [ ] Tests (Behave): Add/update scenarios in `features/` to assert that the `ERROR` log does not contain the exception message body - [ ] Tests (Behave): Add scenario asserting the `DEBUG` log does contain the (redacted) exception message when debug logging is enabled - [ ] Verify coverage ≥ 97% via `nox -s coverage_report` - [ ] Run `nox` (all default sessions), fix any errors ## Definition of Done - [ ] All subtasks above are checked - [ ] The `ERROR`-level log in `wrap_unexpected` contains **only** the exception type — no message content - [ ] The `DEBUG`-level log contains the redacted exception message and is gated behind the debug log level - [ ] Commit created with exact message: `fix(error_handling): avoid logging raw exception message at ERROR level in wrap_unexpected` - [ ] Commit pushed to branch `fix/security-wrap-unexpected-no-error-log-message` - [ ] Pull Request opened, reviewed (≥ 2 approvals), and merged - [ ] All nox stages pass - [ ] Coverage ≥ 97% --- **Automated by CleverAgents Bot** Supervisor: Bug Hunting | Agent: ca-new-issue-creator

Rows
Columns

BUG: [security] Sensitive data may leak into logs via wrap_unexpected exception message #4153