fix: stop leaking Python tracebacks in streaming SSE error responses (#20850)

When a guardrail (e.g. Zscaler AI Guard) or other exception is raised
during streaming, the error handler in `async_data_generator` includes
the full Python traceback in the SSE response sent to clients:

    error_msg = f"{str(e)}\n\n{traceback.format_exc()}"

This leaks internal server details (file paths, line numbers, call
stacks) to end users. The traceback is already logged server-side via
`verbose_proxy_logger.exception()`, so including it in the client
response is unnecessary.

Change to only include the exception message (`str(e)`) in the SSE
error payload, consistent with how `StreamingCallbackError` is already
handled.

Fixes #20610
This commit is contained in:
The Mavik
2026-02-10 22:04:33 -08:00
committed by GitHub
parent c0de6c5c6c
commit 6b4db0caeb
+8 -4
View File
@@ -4705,8 +4705,10 @@ async def async_assistants_data_generator(
if isinstance(e, HTTPException):
raise e
else:
error_traceback = traceback.format_exc()
error_msg = f"{str(e)}\n\n{error_traceback}"
# Only include the error message, not the traceback.
# The traceback is already logged above via verbose_proxy_logger.exception().
# Including it in the SSE response leaks internal details to clients.
error_msg = str(e)
proxy_exception = ProxyException(
message=getattr(e, "message", error_msg),
@@ -4856,8 +4858,10 @@ async def async_data_generator(
elif isinstance(e, StreamingCallbackError):
error_msg = str(e)
else:
error_traceback = traceback.format_exc()
error_msg = f"{str(e)}\n\n{error_traceback}"
# Only include the error message, not the traceback.
# The traceback is already logged above via verbose_proxy_logger.exception().
# Including it in the SSE response leaks internal details to clients.
error_msg = str(e)
proxy_exception = ProxyException(
message=getattr(e, "message", error_msg),