mirror of
https://github.com/tiennm99/litellm.git
synced 2026-08-06 00:23:19 +00:00
fix: stop leaking Python tracebacks in streaming SSE error responses (#20850)
When a guardrail (e.g. Zscaler AI Guard) or other exception is raised
during streaming, the error handler in `async_data_generator` includes
the full Python traceback in the SSE response sent to clients:
error_msg = f"{str(e)}\n\n{traceback.format_exc()}"
This leaks internal server details (file paths, line numbers, call
stacks) to end users. The traceback is already logged server-side via
`verbose_proxy_logger.exception()`, so including it in the client
response is unnecessary.
Change to only include the exception message (`str(e)`) in the SSE
error payload, consistent with how `StreamingCallbackError` is already
handled.
Fixes #20610
This commit is contained in:
@@ -4705,8 +4705,10 @@ async def async_assistants_data_generator(
|
||||
if isinstance(e, HTTPException):
|
||||
raise e
|
||||
else:
|
||||
error_traceback = traceback.format_exc()
|
||||
error_msg = f"{str(e)}\n\n{error_traceback}"
|
||||
# Only include the error message, not the traceback.
|
||||
# The traceback is already logged above via verbose_proxy_logger.exception().
|
||||
# Including it in the SSE response leaks internal details to clients.
|
||||
error_msg = str(e)
|
||||
|
||||
proxy_exception = ProxyException(
|
||||
message=getattr(e, "message", error_msg),
|
||||
@@ -4856,8 +4858,10 @@ async def async_data_generator(
|
||||
elif isinstance(e, StreamingCallbackError):
|
||||
error_msg = str(e)
|
||||
else:
|
||||
error_traceback = traceback.format_exc()
|
||||
error_msg = f"{str(e)}\n\n{error_traceback}"
|
||||
# Only include the error message, not the traceback.
|
||||
# The traceback is already logged above via verbose_proxy_logger.exception().
|
||||
# Including it in the SSE response leaks internal details to clients.
|
||||
error_msg = str(e)
|
||||
|
||||
proxy_exception = ProxyException(
|
||||
message=getattr(e, "message", error_msg),
|
||||
|
||||
Reference in New Issue
Block a user