You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@tooling.apache.org by "sbp (via GitHub)" <gi...@apache.org> on 2026/09/30 20:16:34 UTC

[I] Hide SVN command details in announcement errors (tooling-trusted-releases)

sbp opened a new issue, #1696:
URL: https://github.com/apache/tooling-trusted-releases/issues/1696

   SVN command error details included in 409 response (announce path)
   
   **Vulnerable code:**
   ```python
       except svn.CommandExecutionError as exc:
           raise storage.AccessError(
               f"The local SVN publish repository could not be checked: {svn.error_message(exc)}",
               status=409,
           ) from None
   ```
   
   **Data flow:** `svn.export()` → `svn.CommandExecutionError` → `svn.error_message(exc)` → user-facing 409 response.
   
   **Attacker capability required:** Authenticated Release Manager; SVN server in degraded state.
   
   **Impact on success:** Minor information disclosure. `svn.error_message()` may include SVN server hostname, port, or internal repository path structure.
   
   **Remediation**
   
   ```python
       except svn.CommandExecutionError as exc:
           log.warning(f"SVN export failed for revision {svn_revision}: {exc}")
           raise storage.AccessError(
               "The local SVN publish repository could not be checked. "
               "Please verify the SVN service is operational and try again.",
               status=409,
           ) from None
   ```


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@tooling.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Hide SVN command details in announcement errors (tooling-trusted-releases)

Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #1696:
URL: https://github.com/apache/tooling-trusted-releases/issues/1696#issuecomment-5935064263

   Resolved by f5b6f57a2203077c523ecf8555f177f3650f3dbc.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@tooling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Hide SVN command details in announcement errors (tooling-trusted-releases)

Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp closed issue #1696: Hide SVN command details in announcement errors
URL: https://github.com/apache/tooling-trusted-releases/issues/1696


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@tooling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org