From d8f3ba86bf4ce30d3fce55633262adca6221cae5 Mon Sep 17 00:00:00 2001 From: Sebastion Date: Mon, 6 Apr 2026 09:03:00 +0100 Subject: [PATCH] fix: redact code content and response data from log output (CWE-532) Code.run() previously logged the full code body and full response data in plaintext via log_operation_start() and log_operation_success(). In agent frameworks where code may contain secrets, API keys, or credentials, this creates a credential harvesting vector for anyone with log access. Changes: - Replace Code={code} with CodeLength={len(code)} in operation start log - Replace ResponseData={result.data} with RequestId={result.request_id} in operation success log This follows the same pattern used by Command.execute which logs command metadata without dumping the full content. --- agb/modules/code.py | 8 +++----- python/agb/modules/code.py | 9 ++++----- 2 files changed, 7 insertions(+), 10 deletions(-) diff --git a/agb/modules/code.py b/agb/modules/code.py index ab22bd1..311fc2a 100644 --- a/agb/modules/code.py +++ b/agb/modules/code.py @@ -60,15 +60,13 @@ def run( execution_count=None, execution_time=0.0 ) - log_operation_start("Code.run", f"Language={language}, TimeoutS={timeout_s}, Code={code}") + log_operation_start("Code.run", f"Language={language}, TimeoutS={timeout_s}, CodeLength={len(code)}") args = {"code": code, "language": canonical_language, "timeout_s": timeout_s} result = self._call_mcp_tool("run_code", args) if result.success: - # result_msg = f"RequestId={result.request_id}, ResultLength={result.data if result.data else 0}" - # log_operation_success("Code.run", result_msg) - # Parse the run specific result format - log_operation_success("Code.run", f"ResponseData={result.data}") + result_msg = f"RequestId={result.request_id}" + log_operation_success("Code.run", result_msg) parsed_result = self._parse_run_code_result(result.data, result.request_id) return parsed_result else: diff --git a/python/agb/modules/code.py b/python/agb/modules/code.py index 43e5039..5cf5df7 100644 --- a/python/agb/modules/code.py +++ b/python/agb/modules/code.py @@ -72,7 +72,8 @@ def run( execution_time=0.0, ) log_operation_start( - "Code.run", f"Language={language}, TimeoutS={timeout_s}, Code={code}" + "Code.run", + f"Language={language}, TimeoutS={timeout_s}, CodeLength={len(code)}", ) args = { "code": code, @@ -82,10 +83,8 @@ def run( result = self._call_mcp_tool("run_code", args) if result.success: - # result_msg = f"RequestId={result.request_id}, ResultLength={result.data if result.data else 0}" - # log_operation_success("Code.run", result_msg) - # Parse the run specific result format - log_operation_success("Code.run", f"ResponseData={result.data}") + result_msg = f"RequestId={result.request_id}" + log_operation_success("Code.run", result_msg) parsed_result = self._parse_run_code_result( result.data, result.request_id )