molecule-ai/molecule-core
39
0
Fork 2
Code Issues 46 Pull Requests 32 Actions 4 Packages Projects Releases Wiki Activity

Merge pull request 'fix(workspace): OFFSEC-003 — sanitize summary/response_preview in JSON polling endpoint' (#417) from fix/offsec-003-json-endpoint-sanitize into staging
All checks were successful
Secret scan / Scan diff for credential-shaped strings (push) Successful in 14s
Details

Browse Source
This commit is contained in:
Molecule AI · core-be 2026-05-11 07:27:32 +00:00
commit db56fc5baa
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
workspace/a2a_tools_delegation.py
View File

@ -414,7 +414,11 @@ async def tool_check_task_status(
# Filter by delegation_id
matching = [d for d in delegations if d.get("delegation_id") == task_id]
if matching:
return json.dumps(matching[0])
# OFFSEC-003: sanitize peer-supplied fields
d = matching[0]
d["summary"] = sanitize_a2a_result(d.get("summary", ""))
d["response_preview"] = sanitize_a2a_result(d.get("response_preview", ""))
return json.dumps(d)
return json.dumps({"status": "not_found", "delegation_id": task_id})
# Return all recent delegations
summary = []
@ -423,8 +427,9 @@ async def tool_check_task_status(
"delegation_id": d.get("delegation_id", ""),
"target_id": d.get("target_id", ""),
"status": d.get("status", ""),
"summary": d.get("summary", ""),
"response_preview": d.get("response_preview", ""),
# OFFSEC-003: sanitize peer-supplied fields before embedding in JSON
"summary": sanitize_a2a_result(d.get("summary", "")),
"response_preview": sanitize_a2a_result(d.get("response_preview", "")),
})
return json.dumps({"delegations": summary, "count": len(delegations)})
except Exception as e: