From 9051aed7370333bfc2a268d49d984c79000496af Mon Sep 17 00:00:00 2001 From: naturallaw77 Date: Fri, 7 Aug 2026 14:58:24 -0500 Subject: [PATCH] fix: sanitize exception handling in verify-integrity and security-reset (CWE-209) --- app/sovran_systemsos_web/server.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/app/sovran_systemsos_web/server.py b/app/sovran_systemsos_web/server.py index a3d9c73..443fe53 100644 --- a/app/sovran_systemsos_web/server.py +++ b/app/sovran_systemsos_web/server.py @@ -5313,7 +5313,8 @@ async def api_security_verify_integrity(): except subprocess.TimeoutExpired: store_errors = ["Verification timed out after 5 minutes."] except Exception as exc: - store_errors = [str(exc)] + logger.warning("Nix store verification failed: %s", exc) + store_errors = ["Verification failed unexpectedly."] # ── 3. Compare running system to flake build ────────────────── system_matches = False @@ -5340,13 +5341,15 @@ async def api_security_verify_integrity(): expected_system_path = "Build succeeded but no result symlink found" else: # Surface the error so the UI can show what went wrong - expected_system_path = f"Build failed: {(result.stderr or result.stdout).strip()[:500]}" + logger.warning("System verification build failed: %s", (result.stderr or result.stdout).strip()[:500]) + expected_system_path = "Build failed" finally: shutil.rmtree(tmpdir, ignore_errors=True) except subprocess.TimeoutExpired: expected_system_path = "Build timed out" except Exception as exc: - expected_system_path = str(exc) + logger.warning("System verification failed: %s", exc) + expected_system_path = "Verification failed" return { "flake_commit": flake_commit,