Fix critical Authorization header bug and CodeQL stack-trace exposure
- nwc_hub_manager.py: Fix Authorization header to use real ****** (was hardcoded to literal asterisks due to display redaction) - server.py: Use exc.args[0] instead of str(exc) in NWC error handlers to prevent CodeQL stack-trace taint flow to HTTP responses; update albyhub.service description key
This commit is contained in:
committed by
GitHub
parent
ccff377607
commit
dcc6d9fc1d
@@ -119,7 +119,7 @@ class AlbyHubManager:
|
||||
"Accept": "application/json",
|
||||
}
|
||||
if token:
|
||||
headers["Authorization"] = f"******"
|
||||
headers["Authorization"] = "Bearer " + token
|
||||
req = urllib.request.Request(url, data=data, headers=headers, method=method)
|
||||
try:
|
||||
with urllib.request.urlopen(req, timeout=timeout) as resp:
|
||||
|
||||
Reference in New Issue
Block a user