You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@tooling.apache.org by "sbp (via GitHub)" <gi...@apache.org> on 2026/09/30 20:16:26 UTC

[I] Hide exception details in Trusted Publisher authentication errors (tooling-trusted-releases)

sbp opened a new issue, #1693:
URL: https://github.com/apache/tooling-trusted-releases/issues/1693

   Raw exception message included in 401 response for Trusted Publisher authentication
   
   **Vulnerable code:**
   ```python
       except (interaction.InteractionError, pyjwt.InvalidTokenError, pydantic.ValidationError) as exc:
           raise base.ASFQuartException(f"Trusted Publisher auth failed: {exc}", errorcode=401) from exc
   ```
   
   **Data flow:** External request body (`publisher`, `jwt`) → `interaction.validate_trusted_jwt` → exception → `f"Trusted Publisher auth failed: {exc}"` → JSON response `{"error": "..."}`.
   
   **Attacker capability required:** Remote unauthenticated attacker sends malformed Trusted Publisher requests.
   
   **Impact on success:** A `pydantic.ValidationError` string includes field names, expected types, and `input_value` from the request, revealing internal model structure. An `InteractionError` could include internal service details.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@tooling.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Hide exception details in Trusted Publisher authentication errors (tooling-trusted-releases)

Posted by "alitheg (via GitHub)" <gi...@apache.org>.
alitheg commented on issue #1693:
URL: https://github.com/apache/tooling-trusted-releases/issues/1693#issuecomment-5929144995

   I'll pick this up now since I'm doing #1653 anyway


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@tooling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Hide exception details in Trusted Publisher authentication errors (tooling-trusted-releases)

Posted by "alitheg (via GitHub)" <gi...@apache.org>.
alitheg closed issue #1693: Hide exception details in Trusted Publisher authentication errors
URL: https://github.com/apache/tooling-trusted-releases/issues/1693


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@tooling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org