fix(serve): hide exception details in web errors

Author: saagpatel

src/serve/routes.py

@@ -404,9 +404,9 @@ async def approve_campaign_action(request: Request, packet_id: str, idx: int) ->
     output_dir = _output_dir(request)
     try:
         _approve_action(packet_id, idx, output_dir)
-    except (ValueError, IndexError) as exc:
+    except (ValueError, IndexError):
         return HTMLResponse(
-            f'<tr><td colspan="6" class="error">Not found: {_escape(exc)}</td></tr>',
+            '<tr><td colspan="6" class="error">Not found.</td></tr>',
             status_code=404,
         )
 
@@ -441,9 +441,9 @@ async def reject_campaign_action(
     output_dir = _output_dir(request)
     try:
         _reject_action(packet_id, idx, output_dir, reason=reason)
-    except (ValueError, IndexError) as exc:
+    except (ValueError, IndexError):
         return HTMLResponse(
-            f'<tr><td colspan="6" class="error">Not found: {_escape(exc)}</td></tr>',
+            '<tr><td colspan="6" class="error">Not found.</td></tr>',
             status_code=404,
         )
 
@@ -573,9 +573,9 @@ async def approve_section_route(request: Request, record_id: str) -> HTMLRespons
     output_dir = _output_dir(request)
     try:
         _approve_section(record_id, output_dir)
-    except ValueError as exc:
+    except ValueError:
         return HTMLResponse(
-            f'<div class="section-card section-card--error">Not found: {_escape(exc)}</div>',
+            '<div class="section-card section-card--error">Not found.</div>',
             status_code=404,
         )
 
@@ -605,9 +605,9 @@ async def reject_section_route(
     output_dir = _output_dir(request)
     try:
         _reject_section(record_id, output_dir, reason=reason)
-    except ValueError as exc:
+    except ValueError:
         return HTMLResponse(
-            f'<div class="section-card section-card--error">Not found: {_escape(exc)}</div>',
+            '<div class="section-card section-card--error">Not found.</div>',
             status_code=404,
         )
 
@@ -781,9 +781,9 @@ async def accept_initiative_route(
 
     try:
         truth = json.loads(truth_path.read_text())
-    except (OSError, json.JSONDecodeError) as exc:
+    except (OSError, json.JSONDecodeError):
         return HTMLResponse(
-            f'<div class="suggestion-card accept-error">Error: failed to read portfolio-truth: {_escape(exc)}</div>',
+            '<div class="suggestion-card accept-error">Error: failed to read portfolio truth.</div>',
             status_code=400,
         )
 
@@ -797,9 +797,9 @@ async def accept_initiative_route(
             deadline=deadline,
             target_tier=target_tier,
         )
-    except ValueError as exc:
+    except ValueError:
         return HTMLResponse(
-            f'<div class="suggestion-card accept-error">Error: {_escape(exc)}</div>',
+            '<div class="suggestion-card accept-error">Error: unable to accept initiative.</div>',
             status_code=400,
         )
 
@@ -826,9 +826,9 @@ async def dismiss_suggestion_route(
         entry = dismiss_suggestion_record(
             dismissed_path(output_dir), repo_name=repo_name, reason=reason
         )
-    except ValueError as exc:
+    except ValueError:
         return HTMLResponse(
-            f'<div class="suggestion-card accept-error">Error: {_escape(exc)}</div>',
+            '<div class="suggestion-card accept-error">Error: unable to dismiss suggestion.</div>',
             status_code=400,
         )
 

tests/test_initiatives_suggestions_route.py

@@ -319,8 +319,10 @@ def test_re_accepting_same_repo_is_idempotent(
         matching = [i for i in data["initiatives"] if i["repo_name"] == "IdempotentRepo"]
         assert len(matching) == 1  # upserted, not duplicated
 
-    def test_xss_repo_name_is_escaped_in_error(self, output_dir: Path, client: TestClient) -> None:
-        """XSS payload in repo_name is HTML-escaped in error response."""
+    def test_xss_repo_name_is_not_echoed_in_error(
+        self, output_dir: Path, client: TestClient
+    ) -> None:
+        """XSS payload in repo_name is not reflected in the error response."""
         truth = _make_portfolio_truth([_bronze_repo("SafeRepo")])
         (output_dir / "portfolio-truth-latest.json").write_text(json.dumps(truth))
 
@@ -335,10 +337,9 @@ def test_xss_repo_name_is_escaped_in_error(self, output_dir: Path, client: TestC
         )
 
         assert resp.status_code == 400
-        # Raw script tag must NOT appear verbatim
         assert "<script>" not in resp.text
-        # Escaped form should be present
-        assert "&lt;script&gt;" in resp.text
+        assert "&lt;script&gt;" not in resp.text
+        assert "unable to accept initiative" in resp.text
 
 
 # ── Nav link ─────────────────────────────────────────────────────────────────

tests/test_serve.py

@@ -573,6 +573,30 @@ def test_section_card_values_are_escaped(self) -> None:
         assert "<h1>bad</h1>" in html
         assert "<script>alert(1)</script>" in html
 
+    def test_campaign_action_error_hides_exception_details(self, client: TestClient) -> None:
+        with patch(
+            "src.plan_campaign.approve_action",
+            side_effect=ValueError("internal stack trace /tmp/private.py:99"),
+        ):
+            resp = client.post("/approvals/packet-1/actions/0/approve")
+
+        assert resp.status_code == 404
+        assert "Not found." in resp.text
+        assert "internal stack trace" not in resp.text
+        assert "/tmp/private.py" not in resp.text
+
+    def test_section_error_hides_exception_details(self, client: TestClient) -> None:
+        with patch(
+            "src.draft_readmes.approve_section",
+            side_effect=ValueError("internal stack trace /tmp/private.py:99"),
+        ):
+            resp = client.post("/approvals/sections/section-1/approve")
+
+        assert resp.status_code == 404
+        assert "Not found." in resp.text
+        assert "internal stack trace" not in resp.text
+        assert "/tmp/private.py" not in resp.text
+
 
 # ---------------------------------------------------------------------------
 # CLI wiring smoke test (no server start)