Skip to content

Commit d072835

Browse files
dave-gray101dave-gray101
authored
feat:OpaqueErrors to hide error information (#2486)
* adds a new configuration option to hide all error message information from http requests --------- Signed-off-by: Dave Lee <[email protected]>
1 parent 17cf6c4 commit d072835

File tree

10 files changed

+77
-40
lines changed

10 files changed

+77
-40
lines changed

‎core/cli/run.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ type RunCMD struct {
4747
UploadLimit int `env:"LOCALAI_UPLOAD_LIMIT,UPLOAD_LIMIT" default:"15" help:"Default upload-limit in MB" group:"api"`
4848
APIKeys []string `env:"LOCALAI_API_KEY,API_KEY" help:"List of API Keys to enable API authentication. When this is set, all the requests must be authenticated with one of these API keys" group:"api"`
4949
DisableWebUI bool `env:"LOCALAI_DISABLE_WEBUI,DISABLE_WEBUI" default:"false" help:"Disable webui" group:"api"`
50+
OpaqueErrors bool `env:"LOCALAI_OPAQUE_ERRORS" default:"false" help:"If true, all error responses are replaced with blank 500 errors. This is intended only for hardening against information leaks and is normally not recommended." group:"api"`
5051
Peer2Peer bool `env:"LOCALAI_P2P,P2P" name:"p2p" default:"false" help:"Enable P2P mode" group:"p2p"`
5152
Peer2PeerToken string `env:"LOCALAI_P2P_TOKEN,P2P_TOKEN" name:"p2ptoken" help:"Token for P2P mode (optional)" group:"p2p"`
5253
ParallelRequests bool `env:"LOCALAI_PARALLEL_REQUESTS,PARALLEL_REQUESTS" help:"Enable backends to handle multiple requests in parallel if they support it (e.g.: llama.cpp or vllm)" group:"backends"`
@@ -85,6 +86,7 @@ func (r *RunCMD) Run(ctx *cliContext.Context) error {
8586
config.WithUploadLimitMB(r.UploadLimit),
8687
config.WithApiKeys(r.APIKeys),
8788
config.WithModelsURL(append(r.Models, r.ModelArgs...)...),
89+
config.WithOpaqueErrors(r.OpaqueErrors),
8890
}
8991

9092
if r.Peer2Peer || r.Peer2PeerToken != "" {

‎core/config/application_config.go

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ type ApplicationConfig struct {
3131
PreloadModelsFromPath string
3232
CORSAllowOrigins string
3333
ApiKeys []string
34+
OpaqueErrors bool
3435

3536
ModelLibraryURL string
3637

@@ -287,6 +288,12 @@ func WithApiKeys(apiKeys []string) AppOption {
287288
}
288289
}
289290

291+
func WithOpaqueErrors(opaque bool) AppOption {
292+
return func(o *ApplicationConfig) {
293+
o.OpaqueErrors = opaque
294+
}
295+
}
296+
290297
// ToConfigLoaderOptions returns a slice of ConfigLoader Option.
291298
// Some options defined at the application level are going to be passed as defaults for
292299
// all the configuration for the models.

‎core/http/app.go

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -66,15 +66,19 @@ var embedDirStatic embed.FS
6666
// @name Authorization
6767

6868
func App(cl *config.BackendConfigLoader, ml *model.ModelLoader, appConfig *config.ApplicationConfig) (*fiber.App, error) {
69-
// Return errors as JSON responses
70-
app := fiber.New(fiber.Config{
69+
70+
fiberCfg := fiber.Config{
7171
Views: renderEngine(),
7272
BodyLimit: appConfig.UploadLimitMB * 1024 * 1024, // this is the default limit of 4MB
7373
// We disable the Fiber startup message as it does not conform to structured logging.
7474
// We register a startup log line with connection information in the OnListen hook to keep things user friendly though
7575
DisableStartupMessage: true,
7676
// Override default error handler
77-
ErrorHandler: func(ctx *fiber.Ctx, err error) error {
77+
}
78+
79+
if !appConfig.OpaqueErrors {
80+
// Normally, return errors as JSON responses
81+
fiberCfg.ErrorHandler = func(ctx *fiber.Ctx, err error) error {
7882
// Status code defaults to 500
7983
code := fiber.StatusInternalServerError
8084

@@ -90,8 +94,15 @@ func App(cl *config.BackendConfigLoader, ml *model.ModelLoader, appConfig *confi
9094
Error: &schema.APIError{Message: err.Error(), Code: code},
9195
},
9296
)
93-
},
94-
})
97+
}
98+
} else {
99+
// If OpaqueErrors are required, replace everything with a blank 500.
100+
fiberCfg.ErrorHandler = func(ctx *fiber.Ctx, _ error) error {
101+
return ctx.Status(500).SendString("")
102+
}
103+
}
104+
105+
app := fiber.New(fiberCfg)
95106

96107
app.Hooks().OnListen(func(listenData fiber.ListenData) error {
97108
scheme := "http"
@@ -178,7 +189,7 @@ func App(cl *config.BackendConfigLoader, ml *model.ModelLoader, appConfig *confi
178189
utils.LoadConfig(appConfig.ConfigsDir, openai.AssistantsConfigFile, &openai.Assistants)
179190
utils.LoadConfig(appConfig.ConfigsDir, openai.AssistantsFileConfigFile, &openai.AssistantFiles)
180191

181-
galleryService := services.NewGalleryService(appConfig.ModelPath)
192+
galleryService := services.NewGalleryService(appConfig)
182193
galleryService.Start(appConfig.Context, cl)
183194

184195
routes.RegisterElevenLabsRoutes(app, cl, ml, appConfig, auth)

‎core/http/app_test.go

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -222,6 +222,8 @@ var _ = Describe("API test", func() {
222222
Expect(err).ToNot(HaveOccurred())
223223

224224
modelDir = filepath.Join(tmpdir, "models")
225+
err = os.Mkdir(modelDir, 0750)
226+
Expect(err).ToNot(HaveOccurred())
225227
backendAssetsDir := filepath.Join(tmpdir, "backend-assets")
226228
err = os.Mkdir(backendAssetsDir, 0750)
227229
Expect(err).ToNot(HaveOccurred())
@@ -242,13 +244,13 @@ var _ = Describe("API test", func() {
242244
}
243245
out, err := yaml.Marshal(g)
244246
Expect(err).ToNot(HaveOccurred())
245-
err = os.WriteFile(filepath.Join(tmpdir, "gallery_simple.yaml"), out, 0600)
247+
err = os.WriteFile(filepath.Join(modelDir, "gallery_simple.yaml"), out, 0600)
246248
Expect(err).ToNot(HaveOccurred())
247249

248250
galleries := []gallery.Gallery{
249251
{
250252
Name: "test",
251-
URL: "file://" + filepath.Join(tmpdir, "gallery_simple.yaml"),
253+
URL: "file://" + filepath.Join(modelDir, "gallery_simple.yaml"),
252254
},
253255
}
254256

‎core/services/gallery.go

Lines changed: 29 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ package services
33
import (
44
"context"
55
"encoding/json"
6+
"fmt"
67
"os"
78
"path/filepath"
89
"strings"
@@ -16,21 +17,21 @@ import (
1617
)
1718

1819
type GalleryService struct {
19-
modelPath string
20+
appConfig *config.ApplicationConfig
2021
sync.Mutex
2122
C chan gallery.GalleryOp
2223
statuses map[string]*gallery.GalleryOpStatus
2324
}
2425

25-
func NewGalleryService(modelPath string) *GalleryService {
26+
func NewGalleryService(appConfig *config.ApplicationConfig) *GalleryService {
2627
return &GalleryService{
27-
modelPath: modelPath,
28+
appConfig: appConfig,
2829
C: make(chan gallery.GalleryOp),
2930
statuses: make(map[string]*gallery.GalleryOpStatus),
3031
}
3132
}
3233

33-
func prepareModel(modelPath string, req gallery.GalleryModel, cl *config.BackendConfigLoader, downloadStatus func(string, string, string, float64)) error {
34+
func prepareModel(modelPath string, req gallery.GalleryModel, downloadStatus func(string, string, string, float64)) error {
3435

3536
config, err := gallery.GetGalleryConfigFromURL(req.URL, modelPath)
3637
if err != nil {
@@ -74,8 +75,15 @@ func (g *GalleryService) Start(c context.Context, cl *config.BackendConfigLoader
7475
g.UpdateStatus(op.Id, &gallery.GalleryOpStatus{Message: "processing", Progress: 0})
7576

7677
// updates the status with an error
77-
updateError := func(e error) {
78-
g.UpdateStatus(op.Id, &gallery.GalleryOpStatus{Error: e, Processed: true, Message: "error: " + e.Error()})
78+
var updateError func(e error)
79+
if !g.appConfig.OpaqueErrors {
80+
updateError = func(e error) {
81+
g.UpdateStatus(op.Id, &gallery.GalleryOpStatus{Error: e, Processed: true, Message: "error: " + e.Error()})
82+
}
83+
} else {
84+
updateError = func(_ error) {
85+
g.UpdateStatus(op.Id, &gallery.GalleryOpStatus{Error: fmt.Errorf("an error occurred"), Processed: true})
86+
}
7987
}
8088

8189
// displayDownload displays the download progress
@@ -90,7 +98,7 @@ func (g *GalleryService) Start(c context.Context, cl *config.BackendConfigLoader
9098
if op.Delete {
9199
modelConfig := &config.BackendConfig{}
92100
// Galleryname is the name of the model in this case
93-
dat, err := os.ReadFile(filepath.Join(g.modelPath, op.GalleryModelName+".yaml"))
101+
dat, err := os.ReadFile(filepath.Join(g.appConfig.ModelPath, op.GalleryModelName+".yaml"))
94102
if err != nil {
95103
updateError(err)
96104
continue
@@ -111,20 +119,20 @@ func (g *GalleryService) Start(c context.Context, cl *config.BackendConfigLoader
111119
files = append(files, modelConfig.MMProjFileName())
112120
}
113121

114-
err = gallery.DeleteModelFromSystem(g.modelPath, op.GalleryModelName, files)
122+
err = gallery.DeleteModelFromSystem(g.appConfig.ModelPath, op.GalleryModelName, files)
115123
} else {
116124
// if the request contains a gallery name, we apply the gallery from the gallery list
117125
if op.GalleryModelName != "" {
118126
if strings.Contains(op.GalleryModelName, "@") {
119-
err = gallery.InstallModelFromGallery(op.Galleries, op.GalleryModelName, g.modelPath, op.Req, progressCallback)
127+
err = gallery.InstallModelFromGallery(op.Galleries, op.GalleryModelName, g.appConfig.ModelPath, op.Req, progressCallback)
120128
} else {
121-
err = gallery.InstallModelFromGalleryByName(op.Galleries, op.GalleryModelName, g.modelPath, op.Req, progressCallback)
129+
err = gallery.InstallModelFromGalleryByName(op.Galleries, op.GalleryModelName, g.appConfig.ModelPath, op.Req, progressCallback)
122130
}
123131
} else if op.ConfigURL != "" {
124-
startup.PreloadModelsConfigurations(op.ConfigURL, g.modelPath, op.ConfigURL)
125-
err = cl.Preload(g.modelPath)
132+
startup.PreloadModelsConfigurations(op.ConfigURL, g.appConfig.ModelPath, op.ConfigURL)
133+
err = cl.Preload(g.appConfig.ModelPath)
126134
} else {
127-
err = prepareModel(g.modelPath, op.Req, cl, progressCallback)
135+
err = prepareModel(g.appConfig.ModelPath, op.Req, progressCallback)
128136
}
129137
}
130138

@@ -134,13 +142,13 @@ func (g *GalleryService) Start(c context.Context, cl *config.BackendConfigLoader
134142
}
135143

136144
// Reload models
137-
err = cl.LoadBackendConfigsFromPath(g.modelPath)
145+
err = cl.LoadBackendConfigsFromPath(g.appConfig.ModelPath)
138146
if err != nil {
139147
updateError(err)
140148
continue
141149
}
142150

143-
err = cl.Preload(g.modelPath)
151+
err = cl.Preload(g.appConfig.ModelPath)
144152
if err != nil {
145153
updateError(err)
146154
continue
@@ -163,12 +171,12 @@ type galleryModel struct {
163171
ID string `json:"id"`
164172
}
165173

166-
func processRequests(modelPath, s string, cm *config.BackendConfigLoader, galleries []gallery.Gallery, requests []galleryModel) error {
174+
func processRequests(modelPath string, galleries []gallery.Gallery, requests []galleryModel) error {
167175
var err error
168176
for _, r := range requests {
169177
utils.ResetDownloadTimers()
170178
if r.ID == "" {
171-
err = prepareModel(modelPath, r.GalleryModel, cm, utils.DisplayDownloadFunction)
179+
err = prepareModel(modelPath, r.GalleryModel, utils.DisplayDownloadFunction)
172180

173181
} else {
174182
if strings.Contains(r.ID, "@") {
@@ -183,7 +191,7 @@ func processRequests(modelPath, s string, cm *config.BackendConfigLoader, galler
183191
return err
184192
}
185193

186-
func ApplyGalleryFromFile(modelPath, s string, cl *config.BackendConfigLoader, galleries []gallery.Gallery) error {
194+
func ApplyGalleryFromFile(modelPath, s string, galleries []gallery.Gallery) error {
187195
dat, err := os.ReadFile(s)
188196
if err != nil {
189197
return err
@@ -194,15 +202,15 @@ func ApplyGalleryFromFile(modelPath, s string, cl *config.BackendConfigLoader, g
194202
return err
195203
}
196204

197-
return processRequests(modelPath, s, cl, galleries, requests)
205+
return processRequests(modelPath, galleries, requests)
198206
}
199207

200-
func ApplyGalleryFromString(modelPath, s string, cl *config.BackendConfigLoader, galleries []gallery.Gallery) error {
208+
func ApplyGalleryFromString(modelPath, s string, galleries []gallery.Gallery) error {
201209
var requests []galleryModel
202210
err := json.Unmarshal([]byte(s), &requests)
203211
if err != nil {
204212
return err
205213
}
206214

207-
return processRequests(modelPath, s, cl, galleries, requests)
215+
return processRequests(modelPath, galleries, requests)
208216
}

‎core/startup/startup.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -82,13 +82,13 @@ func Startup(opts ...config.AppOption) (*config.BackendConfigLoader, *model.Mode
8282
}
8383

8484
if options.PreloadJSONModels != "" {
85-
if err := services.ApplyGalleryFromString(options.ModelPath, options.PreloadJSONModels, cl, options.Galleries); err != nil {
85+
if err := services.ApplyGalleryFromString(options.ModelPath, options.PreloadJSONModels, options.Galleries); err != nil {
8686
return nil, nil, nil, err
8787
}
8888
}
8989

9090
if options.PreloadModelsFromPath != "" {
91-
if err := services.ApplyGalleryFromFile(options.ModelPath, options.PreloadModelsFromPath, cl, options.Galleries); err != nil {
91+
if err := services.ApplyGalleryFromFile(options.ModelPath, options.PreloadModelsFromPath, options.Galleries); err != nil {
9292
return nil, nil, nil, err
9393
}
9494
}
@@ -164,7 +164,7 @@ func createApplication(appConfig *config.ApplicationConfig) *core.Application {
164164
// app.TextToSpeechBackendService = backend.NewTextToSpeechBackendService(app.ModelLoader, app.BackendConfigLoader, app.ApplicationConfig)
165165

166166
app.BackendMonitorService = services.NewBackendMonitorService(app.ModelLoader, app.BackendConfigLoader, app.ApplicationConfig)
167-
app.GalleryService = services.NewGalleryService(app.ApplicationConfig.ModelPath)
167+
app.GalleryService = services.NewGalleryService(app.ApplicationConfig)
168168
app.ListModelsService = services.NewListModelsService(app.ModelLoader, app.BackendConfigLoader, app.ApplicationConfig)
169169
// app.OpenAIService = services.NewOpenAIService(app.ModelLoader, app.BackendConfigLoader, app.ApplicationConfig, app.LLMBackendService)
170170

‎pkg/downloader/uri.go

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,9 +33,15 @@ func GetURI(url string, basePath string, f func(url string, i []byte) error) err
3333
if err != nil {
3434
return err
3535
}
36+
// ???
37+
resolvedBasePath, err := filepath.EvalSymlinks(basePath)
38+
if err != nil {
39+
return err
40+
}
3641
// Check if the local file is rooted in basePath
37-
err = utils.VerifyPath(resolvedFile, basePath)
42+
err = utils.InTrustedRoot(resolvedFile, resolvedBasePath)
3843
if err != nil {
44+
log.Debug().Str("resolvedFile", resolvedFile).Str("basePath", basePath).Msg("downloader.GetURI blocked an attempt to ready a file url outside of basePath")
3945
return err
4046
}
4147
// Read the response body

‎pkg/gallery/models_test.go

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -50,13 +50,14 @@ var _ = Describe("Model test", func() {
5050
}}
5151
out, err := yaml.Marshal(gallery)
5252
Expect(err).ToNot(HaveOccurred())
53-
err = os.WriteFile(filepath.Join(tempdir, "gallery_simple.yaml"), out, 0600)
53+
galleryFilePath := filepath.Join(tempdir, "gallery_simple.yaml")
54+
err = os.WriteFile(galleryFilePath, out, 0600)
5455
Expect(err).ToNot(HaveOccurred())
55-
56+
Expect(filepath.IsAbs(galleryFilePath)).To(BeTrue(), galleryFilePath)
5657
galleries := []Gallery{
5758
{
5859
Name: "test",
59-
URL: "file://" + filepath.Join(tempdir, "gallery_simple.yaml"),
60+
URL: "file://" + galleryFilePath,
6061
},
6162
}
6263

‎pkg/model/initializers.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -466,10 +466,10 @@ func (ml *ModelLoader) GreedyLoader(opts ...Option) (grpc.Backend, error) {
466466
log.Info().Msgf("[%s] Loads OK", key)
467467
return model, nil
468468
} else if modelerr != nil {
469-
err = errors.Join(err, modelerr)
469+
err = errors.Join(err, fmt.Errorf("[%s]: %w", key, modelerr))
470470
log.Info().Msgf("[%s] Fails: %s", key, modelerr.Error())
471471
} else if model == nil {
472-
err = errors.Join(err, fmt.Errorf("backend returned no usable model"))
472+
err = errors.Join(err, fmt.Errorf("backend %s returned no usable model", key))
473473
log.Info().Msgf("[%s] Fails: %s", key, "backend returned no usable model")
474474
}
475475
}

‎pkg/utils/path.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ func ExistsInPath(path string, s string) bool {
1212
return err == nil
1313
}
1414

15-
func inTrustedRoot(path string, trustedRoot string) error {
15+
func InTrustedRoot(path string, trustedRoot string) error {
1616
for path != "/" {
1717
path = filepath.Dir(path)
1818
if path == trustedRoot {
@@ -25,7 +25,7 @@ func inTrustedRoot(path string, trustedRoot string) error {
2525
// VerifyPath verifies that path is based in basePath.
2626
func VerifyPath(path, basePath string) error {
2727
c := filepath.Clean(filepath.Join(basePath, path))
28-
return inTrustedRoot(c, filepath.Clean(basePath))
28+
return InTrustedRoot(c, filepath.Clean(basePath))
2929
}
3030

3131
// SanitizeFileName sanitizes the given filename

0 commit comments

Comments
 (0)