fix: redact dashboard health exception details by minyanyi · Pull Request #5457 · Scottcjn/Rustchain

minyanyi · 2026-05-16T15:41:49Z

Fixes #5442.

Summary

Stop returning raw database, Solana RPC, and wRTC mint exception text from /bridge/dashboard/health.
Log full exception details server-side with logger.exception(...).
Add regression tests that inject private paths/RPC tokens and assert the response uses generic client-facing detail strings.

Verification

python -m pytest bridge/test_dashboard_api.py::TestBridgeHealth -q -> 7 passed
python -m pytest bridge/test_dashboard_api.py -q -> 25 passed
python -m py_compile bridge\dashboard_api.py bridge\test_dashboard_api.py
git diff --check

Wallet for accepted bounty payout: RTC0197a0573c0239ab6a4483108b27769317d3490b

Signed-off-by: minyanyi <109479933+minyanyi@users.noreply.github.com>

github-actions · 2026-05-16T15:41:57Z

Welcome to RustChain! Thanks for your first pull request.

Before we review, please make sure:

Non-doc PRs have a BCOS-L1 or BCOS-L2 label
Doc-only PRs are exempt from BCOS tier labels when they only touch docs/**, *.md, or common image/PDF files
New code files include an SPDX license header
You've tested your changes against the live node

Bounty tiers: Micro (1-10 RTC) | Standard (20-50) | Major (75-100) | Critical (100-150)

A maintainer will review your PR soon. Thanks for contributing!

kekehanshujun

Reviewed the dashboard health redaction changes.

The patch now keeps raw database/RPC/mint exception text out of the client-facing details payload while preserving server-side diagnostic context via logger.exception(...). The added tests cover sensitive filesystem paths, private RPC URLs, and mint lookup errors, and the existing health response shape remains intact.

Verification run locally on the PR version:

python -m pytest bridge\test_dashboard_api.py::TestBridgeHealth -q -o addopts='' -> 7 passed
python -m pytest bridge\test_dashboard_api.py -q -o addopts='' -> 25 passed
python -m py_compile bridge\dashboard_api.py bridge\test_dashboard_api.py -> passed

jaxint

LGTM! Thanks for contributing. Approved.

yui-stingray · 2026-05-16T17:10:47Z

I took a look at the failing test check because the patch itself is small and already has targeted validation.

The CI failure does not appear to come from the dashboard health redaction changes. The failing step is the broad pytest tests/ ... collection phase, and it stops on missing dependencies from unrelated test modules:

tests/test_agent_economy_sdk.py -> ModuleNotFoundError: No module named 'aiohttp'
tests/test_faucet_service_wallet_validation.py -> ModuleNotFoundError: No module named 'flask_cors'
tests/test_hardware_visualizer.py -> ModuleNotFoundError: No module named 'matplotlib'
tests/test_pse_analyze_results.py -> ModuleNotFoundError: No module named 'matplotlib'

The earlier CI steps passed, including lint, the security scan, and the attestation fuzz gate. The targeted bridge dashboard tests reported in the PR body are the right scope for this change, so this looks like a repo-wide CI dependency/setup issue rather than a regression introduced by #5457.

HCIE2054

LGTM!

HCIE2054

LGTM!

ZacharyZhang-NY

Reviewed PR #5457 at head 0894074.

Validation performed:

Checked issue #5442. The scoped bug is raw exception detail disclosure from /bridge/dashboard/health for database, Solana RPC, and configured wRTC mint checks.
git fetch origin pull/5457/head:review-pr-5457 --force
git diff --check origin/main...review-pr-5457 -- bridge/dashboard_api.py bridge/test_dashboard_api.py -> passed.
python -m py_compile bridge/dashboard_api.py bridge/test_dashboard_api.py on an extracted PR-head tree -> passed.
python -m pytest bridge/test_dashboard_api.py::TestBridgeHealth -q --confcutdir= -> 7 passed.
python -m pytest bridge/test_dashboard_api.py -q --confcutdir= -> 25 passed.

The health endpoint now reports degraded component status with stable client-facing detail strings for database, Solana RPC, and wRTC mint failures, while preserving full exception details in server-side logs through logger.exception(...). The regression coverage injects private paths/tokens/account text and confirms those values stay out of the HTTP response. Approving.

HCIE2054

LGTM!

HCIE2054

LGTM!

TJCurnutte

Approved. I focused on the /bridge/dashboard/health failure paths that previously returned raw exception text.

Validation run against head 0894074db7c1071f8575fc58e8d66552bee9b9a2:

git diff --check origin/main...HEAD -- bridge/dashboard_api.py bridge/test_dashboard_api.py
PYTHONPATH=. python3 -B -m py_compile bridge/dashboard_api.py bridge/test_dashboard_api.py
PYTHONPATH=. uv run --no-project --with pytest --with flask --with requests python -B -m pytest -q bridge/test_dashboard_api.py --noconftest

Results: diff-check and py_compile passed; the focused dashboard API test file passed with 25 passed in 1.64s.

The patch keeps the health endpoint useful while avoiding disclosure: database exceptions now return Database unavailable, Solana RPC exceptions return RPC unavailable, and mint lookup exceptions return Mint check unavailable, while the detailed exception still goes to the server log via logger.exception(...). The added tests exercise each failure class with secret-looking values and assert those values are not present in the HTTP response body.

BossChaos · 2026-05-17T03:29:06Z

Code Review — Bounty #73

PR: fix: redact dashboard health exception details by @minyanyi
Files changed: 2 (+105/-6)

✅ Bug fix or input validation
✅ Input validation present
✅ Error handling present

Summary

This is a bug fix PR. Changes appear consistent with project patterns.

Wallet: 0xdaE5d307339074A24F579dB48e7c639359D94904

Reviewing under Bounty #73 — Code Review Bounty Program

HCIE2054

LGTM!

HCIE2054

LGTM!

HCIE2054

LGTM!

508704820

Redact dashboard health exception details. Good - health checks can expose service topology. Verify redaction is consistent across all health endpoints. - Xeophon (security review)

HCIE2054

LGTM!

HCIE2054

LGTM!

minyanyi · 2026-05-17T17:34:29Z

CI follow-up: I opened #5587 to fix the current blocking pytest tests/ collection failure caused by missing test dependencies (aiohttp, flask_cors, and matplotlib). This matches the red CI seen here and looks unrelated to the dashboard health redaction patch.

Focused validation for this PR remains the relevant signal for the changed files; the branch is still mergeable and already has review coverage.

Scottcjn · 2026-05-18T03:00:46Z

Closing as duplicate of #5443 by @hungle123-dev (first-posted 90 min earlier on the same issue).

Per first-poster rule, only the original submitter gets bounty credit on a given issue. The fix in #5443 addresses the same root cause and is already under review.

Appreciate the effort — for next time, please check open PRs against the same issue before filing. Thanks for the contribution.

fix: redact dashboard health exception details

0894074

Signed-off-by: minyanyi <109479933+minyanyi@users.noreply.github.com>

github-actions Bot added BCOS-L1 Beacon Certified Open Source tier BCOS-L1 (required for non-doc PRs) size/M PR: 51-200 lines labels May 16, 2026

minyanyi mentioned this pull request May 16, 2026

[Bug] Dashboard health leaks internal component exception details #5442

Closed

kekehanshujun approved these changes May 16, 2026

View reviewed changes

kekehanshujun mentioned this pull request May 16, 2026

Bounty claim: code review for RustChain PR #5457 Scottcjn/rustchain-bounties#10038

Closed

jaxint approved these changes May 16, 2026

View reviewed changes

kekehanshujun mentioned this pull request May 16, 2026

[BOUNTY] Open an Issue or Comment on Any Scottcjn Repo — 1 RTC Each Scottcjn/rustchain-bounties#254

Open

HCIE2054 approved these changes May 16, 2026

View reviewed changes

ZacharyZhang-NY mentioned this pull request May 16, 2026

fix: hide dashboard health exception details #5443

Merged

ZacharyZhang-NY approved these changes May 16, 2026

View reviewed changes

ZacharyZhang-NY mentioned this pull request May 16, 2026

[Bounty Claim] PR Review - RustChain PR #5457 (Bounty #305) Scottcjn/rustchain-bounties#10204

Open

HCIE2054 approved these changes May 16, 2026

View reviewed changes

TJCurnutte approved these changes May 17, 2026

View reviewed changes

TJCurnutte mentioned this pull request May 17, 2026

[BOUNTY] Code Review Bounty Program — Review PRs, Earn RTC (100 RTC Pool) Scottcjn/rustchain-bounties#73

Open

HCIE2054 approved these changes May 17, 2026

View reviewed changes

508704820 reviewed May 17, 2026

View reviewed changes

HCIE2054 approved these changes May 17, 2026

View reviewed changes

Scottcjn closed this May 18, 2026

Uh oh!

Conversation

minyanyi commented May 16, 2026

Summary

Verification

Uh oh!

github-actions Bot commented May 16, 2026

Uh oh!

kekehanshujun left a comment

Choose a reason for hiding this comment

Uh oh!

jaxint left a comment

Choose a reason for hiding this comment

Uh oh!

yui-stingray commented May 16, 2026

Uh oh!

HCIE2054 left a comment

Choose a reason for hiding this comment

Uh oh!

HCIE2054 left a comment

Choose a reason for hiding this comment

Uh oh!

ZacharyZhang-NY left a comment

Choose a reason for hiding this comment

Uh oh!

HCIE2054 left a comment

Choose a reason for hiding this comment

Uh oh!

HCIE2054 left a comment

Choose a reason for hiding this comment

Uh oh!

TJCurnutte left a comment

Choose a reason for hiding this comment

Uh oh!

BossChaos commented May 17, 2026

Code Review — Bounty #73

Summary

Uh oh!

HCIE2054 left a comment

Choose a reason for hiding this comment

Uh oh!

HCIE2054 left a comment

Choose a reason for hiding this comment

Uh oh!

HCIE2054 left a comment

Choose a reason for hiding this comment

Uh oh!

508704820 left a comment

Choose a reason for hiding this comment

Uh oh!

HCIE2054 left a comment

Choose a reason for hiding this comment

Uh oh!

HCIE2054 left a comment

Choose a reason for hiding this comment

Uh oh!

minyanyi commented May 17, 2026

Uh oh!

Scottcjn commented May 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants