From 31804b9a08ace16bed801c68e75b963eb228c81c Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 17 Jul 2026 01:52:49 +0000
Subject: [PATCH 1/6] fix(security): sanitize all HTTP 500 responses to prevent
 info disclosure (supersedes #801)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Multiple FastAPI handlers returned internal exception text to clients via
`HTTPException(status_code=500, detail=str(e))` (or f-strings embedding `{e}`),
leaking stack-adjacent messages, backend API errors, and database/Looker errors.
This is an information-disclosure vector (CWE-209).

#801 sanitized ~24 handlers but left three live endpoints leaking:
`generate_video_pack` and `generate_blueprint` (v1/router.py) and the mounted
`reporting_routes.py` dashboard endpoint — the exact gaps Copilot flagged on that
PR. A tree-wide scan surfaced 13 further leaks in cloud_ai_routes.py,
cloud_api_endpoints.py, and real_api_endpoints.py that #801 never touched.

Changes:
- Replace the dynamic `detail` in every 500 response across the backend with a
  static "Internal server error"; the full exception is now logged server-side
  (`logger.error(..., exc_info=True)`) so diagnostics are preserved.
- Add reporting_routes.py a module logger (previously none).
- Add tests/unit/test_500_info_disclosure.py: a hermetic source-scan guard that
  fails if any backend 500 response uses a dynamic `detail`, closing the
  test-coverage gap (existing exception-path tests asserted only status code, so
  they passed while the body leaked). Includes a self-check that the scanner
  detects a synthetic leak and ignores 4xx responses.

4xx responses (which echo client-supplied validation input) are intentionally
left unchanged. Verified: all touched files compile; ruff findings are identical
to the base branch (lint-neutral); guard test passes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MF2xHBKyQBQtpdXt6bVRx
---
 .../backend/api/reporting_routes.py           |  7 +-
 .../backend/api/v1/router.py                  | 44 ++++-----
 .../backend/cloud_ai_routes.py                | 10 +-
 .../backend/cloud_api_endpoints.py            |  9 +-
 src/youtube_extension/backend/main.py         |  8 +-
 .../backend/real_api_endpoints.py             | 15 ++-
 tests/unit/test_500_info_disclosure.py        | 94 +++++++++++++++++++
 7 files changed, 147 insertions(+), 40 deletions(-)
 create mode 100644 tests/unit/test_500_info_disclosure.py

diff --git a/src/youtube_extension/backend/api/reporting_routes.py b/src/youtube_extension/backend/api/reporting_routes.py
index 041b1be06..dba800a07 100644
--- a/src/youtube_extension/backend/api/reporting_routes.py
+++ b/src/youtube_extension/backend/api/reporting_routes.py
@@ -1,9 +1,13 @@
+import logging
+
 from fastapi import APIRouter, Depends, HTTPException, Query
 from pydantic import BaseModel
 from typing import Optional
 
 from src.integration.looker_embedded import LookerEmbeddedService
 
+logger = logging.getLogger(__name__)
+
 router = APIRouter(prefix="/api/v1/reporting", tags=["Reporting & Dashboards"])
 
 class DashboardEmbedRequest(BaseModel):
@@ -36,7 +40,8 @@ async def generate_dashboard_url(
         )
         return DashboardEmbedResponse(embed_url=url)
     except Exception as e:
-        raise HTTPException(status_code=500, detail=f"Failed to generate dashboard embed URL: {str(e)}")
+        logger.error(f"Unhandled error in generate_dashboard_url: {e}", exc_info=True)
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 @router.get("/dashboards")
 async def list_available_dashboards(tenant_id: str = Query(...)):
diff --git a/src/youtube_extension/backend/api/v1/router.py b/src/youtube_extension/backend/api/v1/router.py
index 7d33ffb63..275eadc63 100644
--- a/src/youtube_extension/backend/api/v1/router.py
+++ b/src/youtube_extension/backend/api/v1/router.py
@@ -249,7 +249,7 @@ async def health_check_v1(
         return HealthResponse(**health_status)
     except Exception as e:
         logger.error(f"Health check failed: {e}")
-        raise HTTPException(status_code=500, detail=str(e))
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 
 @router.get(
@@ -278,7 +278,7 @@ async def detailed_health_check_v1(
         }
     except Exception as e:
         logger.error(f"Detailed health check failed: {e}")
-        raise HTTPException(status_code=500, detail=str(e))
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 
 # Capabilities / Model availability
@@ -657,7 +657,7 @@ async def chat_v1(
 
     except Exception as e:
         logger.error(f"Error in chat endpoint: {e}", exc_info=True)
-        raise HTTPException(status_code=500, detail=str(e)) from e
+        raise HTTPException(status_code=500, detail="Internal server error") from e
 
 
 # Video Processing Endpoints
@@ -716,7 +716,7 @@ async def process_video_v1(
             {"url": request.video_url, "error": str(e)},
             request.video_url,
         )
-        raise HTTPException(status_code=500, detail=str(e))
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 
 @router.post(
@@ -762,7 +762,7 @@ async def process_video_markdown_v1(
     except Exception as e:
         logger.error(f"Error in markdown processing: {e}")
         health_service.increment_metric("error_total")
-        raise HTTPException(status_code=500, detail=str(e))
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 
 @router.post(
@@ -799,7 +799,7 @@ async def video_to_software_v1(
 
     except Exception as e:
         logger.error(f"Video-to-software processing failed: {e}")
-        raise HTTPException(status_code=500, detail=str(e))
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 
 # Cache Management Endpoints
@@ -823,7 +823,7 @@ async def get_cache_stats_v1(cache_service: CacheService = Depends(get_cache_ser
         return CacheStats(**stats)
     except Exception as e:
         logger.error(f"Error getting cache stats: {e}")
-        raise HTTPException(status_code=500, detail=str(e))
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 
 @router.get(
@@ -852,7 +852,7 @@ async def get_cached_video_v1(
         raise
     except Exception as e:
         logger.error(f"Error retrieving cached video: {e}")
-        raise HTTPException(status_code=500, detail=str(e))
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 
 @router.delete(
@@ -875,7 +875,7 @@ async def clear_video_cache_v1(
         }
     except Exception as e:
         logger.error(f"Error clearing video cache: {e}")
-        raise HTTPException(status_code=500, detail=str(e))
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 
 @router.delete(
@@ -895,7 +895,7 @@ async def clear_all_cache_v1(cache_service: CacheService = Depends(get_cache_ser
         }
     except Exception as e:
         logger.error(f"Error clearing all cache: {e}")
-        raise HTTPException(status_code=500, detail=str(e))
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 
 # Data Endpoints
@@ -933,7 +933,7 @@ async def list_videos_v1(
 
     except Exception as e:
         logger.error(f"Error listing videos: {e}")
-        raise HTTPException(status_code=500, detail=str(e))
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 
 @router.get(
@@ -957,7 +957,7 @@ async def get_video_detail_v1(
         raise
     except Exception as e:
         logger.error(f"Error getting video detail: {e}")
-        raise HTTPException(status_code=500, detail=str(e))
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 
 @router.get(
@@ -973,7 +973,7 @@ async def get_learning_log_v1(data_service: DataService = Depends(get_data_servi
         return learning_log
     except Exception as e:
         logger.error(f"Error getting learning log: {e}")
-        raise HTTPException(status_code=500, detail=str(e))
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 
 @router.post(
@@ -1024,7 +1024,7 @@ async def get_actions_by_video_v1(video_id: str):
         return actions
     except Exception as e:
         logger.error(f"Error retrieving actions for {video_id}: {e}")
-        raise HTTPException(status_code=500, detail=str(e))
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 
 @router.put(
@@ -1072,7 +1072,7 @@ async def update_action_v1(action_id: str, payload: dict[str, Any]):
         return {"success": bool(success)}
     except Exception as e:
         logger.error(f"Error updating action {action_id}: {e}")
-        raise HTTPException(status_code=500, detail=str(e))
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 
 # Feedback Endpoints
@@ -1119,7 +1119,7 @@ async def submit_feedback_v1(
 
     except Exception as e:
         logger.error(f"Error saving feedback: {e}")
-        raise HTTPException(status_code=500, detail=str(e))
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 
 # Metrics Endpoints
@@ -1139,7 +1139,7 @@ async def get_metrics_v1(
         return JSONResponse(content="\n".join(metrics_lines), media_type="text/plain")
     except Exception as e:
         logger.error(f"Metrics endpoint failed: {e}")
-        raise HTTPException(status_code=500, detail=str(e))
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 
 # Frontend performance ingestion endpoints
@@ -1159,7 +1159,7 @@ async def ingest_performance_alert_v1(payload: dict[str, Any]):
         return {"status": "ok", "recorded": metric_name}
     except Exception as e:
         logger.error(f"Failed to ingest performance alert: {e}")
-        raise HTTPException(status_code=500, detail=str(e))
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 
 @router.post("/performance/report", summary="Ingest frontend performance report")
@@ -1177,7 +1177,7 @@ async def ingest_performance_report_v1(report: dict[str, Any]):
         return {"status": "ok", "metrics_recorded": len(metrics)}
     except Exception as e:
         logger.error(f"Failed to ingest performance report: {e}")
-        raise HTTPException(status_code=500, detail=str(e))
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 
 # ============================================================
@@ -1710,7 +1710,7 @@ async def get_or_create_videopack(request: VideoPackRequest):
         return ApiResponse.success(pack.model_dump())
     except Exception as e:
         logger.error(f"Failed to create VideoPack: {e}")
-        raise HTTPException(status_code=500, detail=f"VideoPack generation failed: {e}")
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 
 @router.post(
@@ -1759,7 +1759,7 @@ async def generate_blueprint(request: BlueprintRequest):
         return ApiResponse.success(blueprint)
     except Exception as e:
         logger.error(f"Failed to generate blueprint: {e}")
-        raise HTTPException(status_code=500, detail=f"Blueprint generation failed: {e}")
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 
 @router.post(
@@ -1785,7 +1785,7 @@ async def generate_project_code(request: GenerateCodeRequest):
         return ApiResponse.success(result)
     except Exception as e:
         logger.error(f"Code generation failed: {e}")
-        raise HTTPException(status_code=500, detail=str(e))
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 
 @router.get(
diff --git a/src/youtube_extension/backend/cloud_ai_routes.py b/src/youtube_extension/backend/cloud_ai_routes.py
index a1242a418..0172e1617 100644
--- a/src/youtube_extension/backend/cloud_ai_routes.py
+++ b/src/youtube_extension/backend/cloud_ai_routes.py
@@ -229,7 +229,7 @@ async def get_provider_status():
 
     except Exception as e:
         logger.error(f"Failed to get provider status: {e}")
-        raise HTTPException(status_code=500, detail=f"Failed to get provider status: {str(e)}")
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 
 @router.post("/analyze/video", response_model=VideoAnalysisResponse)
@@ -263,12 +263,12 @@ async def analyze_video(request: VideoAnalysisRequest):
         raise HTTPException(status_code=429, detail=f"Rate limit exceeded: {str(e)}")
     except ConfigurationError as e:
         logger.error(f"Configuration error: {e}")
-        raise HTTPException(status_code=500, detail=f"Configuration error: {str(e)}")
+        raise HTTPException(status_code=500, detail="Internal server error")
     except HTTPException:
         raise
     except Exception as e:
         logger.error(f"Unexpected error during video analysis: {e}")
-        raise HTTPException(status_code=500, detail=f"Analysis failed: {str(e)}")
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 
 @router.post("/analyze/batch")
@@ -301,7 +301,7 @@ async def analyze_batch_videos(request: BatchAnalysisRequest, background_tasks:
         raise
     except Exception as e:
         logger.error(f"Failed to start batch analysis: {e}")
-        raise HTTPException(status_code=500, detail=f"Batch analysis failed: {str(e)}")
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 
 @router.post("/analyze/multi-provider", response_model=list[VideoAnalysisResponse])
@@ -325,7 +325,7 @@ async def analyze_video_multi_provider(request: VideoAnalysisRequest):
 
     except Exception as e:
         logger.error(f"Multi-provider analysis failed: {e}")
-        raise HTTPException(status_code=500, detail=f"Multi-provider analysis failed: {str(e)}")
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 
 @router.get("/analysis-types")
diff --git a/src/youtube_extension/backend/cloud_api_endpoints.py b/src/youtube_extension/backend/cloud_api_endpoints.py
index e38655f99..165bc76c9 100644
--- a/src/youtube_extension/backend/cloud_api_endpoints.py
+++ b/src/youtube_extension/backend/cloud_api_endpoints.py
@@ -260,9 +260,10 @@ async def batch_process_videos_cloud(request: BatchCloudProcessingRequest):
     except HTTPException:
         raise
     except Exception as e:
+        logger.error(f"Unhandled error in batch_process_videos_cloud: {e}", exc_info=True)
         raise HTTPException(
             status_code=500,
-            detail=f"Batch processing failed: {str(e)}"
+            detail="Internal server error"
         )
 
 @router.get("/api/v3/videos/{video_id}/status", response_model=VideoStatusResponse)
@@ -293,9 +294,10 @@ async def get_video_status(video_id: str):
     except HTTPException:
         raise
     except Exception as e:
+        logger.error(f"Unhandled error in get_video_status: {e}", exc_info=True)
         raise HTTPException(
             status_code=500,
-            detail=f"Error retrieving status: {str(e)}"
+            detail="Internal server error"
         )
 
 @router.get("/api/v3/videos/{video_id}/result")
@@ -330,9 +332,10 @@ async def get_video_result(video_id: str):
     except HTTPException:
         raise
     except Exception as e:
+        logger.error(f"Unhandled error in get_video_result: {e}", exc_info=True)
         raise HTTPException(
             status_code=500,
-            detail=f"Error retrieving result: {str(e)}"
+            detail="Internal server error"
         )
 
 @router.get("/api/v3/queue/stats")
diff --git a/src/youtube_extension/backend/main.py b/src/youtube_extension/backend/main.py
index 0e52a9341..e0ffa5c3e 100644
--- a/src/youtube_extension/backend/main.py
+++ b/src/youtube_extension/backend/main.py
@@ -206,7 +206,7 @@ async def legacy_chat(request: dict):
 
     except Exception as e:
         logger.error(f"Legacy chat endpoint error: {e}")
-        raise HTTPException(status_code=500, detail=str(e))
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 
 @app.post("/api/process-video-markdown")
@@ -240,7 +240,7 @@ async def legacy_process_video_markdown(request: dict):
         raise
     except Exception as e:
         logger.error(f"Legacy markdown processing error: {e}")
-        raise HTTPException(status_code=500, detail=str(e))
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 
 @app.post("/api/process-video")
@@ -297,7 +297,7 @@ async def legacy_process_video(request: dict):
 
     except Exception as e:
         logger.error(f"Legacy video processing error: {e}")
-        raise HTTPException(status_code=500, detail=str(e))
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 
 # Other legacy endpoints with redirects
@@ -368,7 +368,7 @@ async def system_info():
 
     except Exception as e:
         logger.error(f"System info error: {e}")
-        raise HTTPException(status_code=500, detail=str(e))
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 
 # Enhanced OpenAPI schema generation
diff --git a/src/youtube_extension/backend/real_api_endpoints.py b/src/youtube_extension/backend/real_api_endpoints.py
index 03fd9e4e6..1b0433cfc 100644
--- a/src/youtube_extension/backend/real_api_endpoints.py
+++ b/src/youtube_extension/backend/real_api_endpoints.py
@@ -150,9 +150,10 @@ async def validate_video_url(request: VideoValidationRequest):
             }
 
         except Exception as e:
+            logger.error(f"Unhandled error in validate_video_url: {e}", exc_info=True)
             raise HTTPException(
                 status_code=500,
-                detail=f"Validation failed: {str(e)}"
+                detail="Internal server error"
             )
 
     @app.post("/api/v2/batch-process")
@@ -177,9 +178,10 @@ async def batch_process_videos(request: BatchProcessingRequest):
             return result
 
         except Exception as e:
+            logger.error(f"Unhandled error in batch_process_videos: {e}", exc_info=True)
             raise HTTPException(
                 status_code=500,
-                detail=f"Batch processing failed: {str(e)}"
+                detail="Internal server error"
             )
 
     @app.get("/api/v2/videos/list")
@@ -252,9 +254,10 @@ async def get_video_analysis(video_id: str):
         except HTTPException:
             raise
         except Exception as e:
+            logger.error(f"Unhandled error in get_video_analysis: {e}", exc_info=True)
             raise HTTPException(
                 status_code=500,
-                detail=f"Error retrieving video analysis: {str(e)}"
+                detail="Internal server error"
             )
 
     @app.get("/api/v2/cost-dashboard")
@@ -384,9 +387,10 @@ async def clear_processing_cache():
             }
 
         except Exception as e:
+            logger.error(f"Unhandled error in clear_processing_cache: {e}", exc_info=True)
             raise HTTPException(
                 status_code=500,
-                detail=f"Failed to clear cache: {str(e)}"
+                detail="Internal server error"
             )
 
     @app.post("/api/v2/search-videos")
@@ -432,9 +436,10 @@ async def search_youtube_videos(
             }
 
         except Exception as e:
+            logger.error(f"Unhandled error in search_youtube_videos: {e}", exc_info=True)
             raise HTTPException(
                 status_code=500,
-                detail=f"Search failed: {str(e)}"
+                detail="Internal server error"
             )
 
     logger.info("🚀 Real API endpoints setup complete")
diff --git a/tests/unit/test_500_info_disclosure.py b/tests/unit/test_500_info_disclosure.py
new file mode 100644
index 000000000..d561c422e
--- /dev/null
+++ b/tests/unit/test_500_info_disclosure.py
@@ -0,0 +1,94 @@
+"""Regression guard against information disclosure in HTTP 500 responses.
+
+Context: several FastAPI handlers historically raised
+``HTTPException(status_code=500, detail=str(e))`` (or an f-string embedding the
+exception), leaking internal exception text — stack-adjacent messages, backend
+API errors, database errors — to clients. See PR #801, which sanitized most but
+not all handlers.
+
+This test encodes the invariant directly on the source: a 500 response must use
+a *static* ``detail`` string, never one derived from the caught exception. It is
+hermetic (pure source scan, no app import / no pydantic) so it runs anywhere and
+catches new leaks in any backend route, not just the ones fixed today.
+
+It deliberately does not constrain 4xx responses: those echo client-supplied
+validation errors, which are not internal-disclosure vectors.
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+import pytest
+
+_BACKEND = Path(__file__).resolve().parents[2] / "src" / "youtube_extension" / "backend"
+
+# Match a single `raise HTTPException(...)` call, capturing its argument list,
+# tolerant of the call spanning multiple lines.
+_HTTP_EXC = re.compile(r"HTTPException\((?P<args>.*?)\)", re.DOTALL)
+
+# A `detail=` argument whose value is derived from a variable/exception:
+#   detail=str(e)              detail=str(exc)
+#   detail=f"... {e} ..."      detail=f"... {str(e)} ..."
+_DYNAMIC_DETAIL = re.compile(
+    r"""detail\s*=\s*(?:
+        str\(                         # detail=str(...)
+      | f["'][^"']*\{                 # detail=f"...{...}..."
+    )""",
+    re.VERBOSE,
+)
+
+
+def _backend_python_files() -> list[Path]:
+    return sorted(_BACKEND.rglob("*.py"))
+
+
+def _iter_500_dynamic_detail(text: str):
+    """Yield (line_no, snippet) for each 500 HTTPException with a dynamic detail."""
+    for m in _HTTP_EXC.finditer(text):
+        args = m.group("args")
+        if "status_code=500" not in args.replace(" ", "").replace(
+            "status_code =", "status_code="
+        ):
+            # normalize minor spacing; only care about 500 responses
+            if "status_code=500" not in re.sub(r"\s+", "", args):
+                continue
+        if _DYNAMIC_DETAIL.search(args):
+            line_no = text.count("\n", 0, m.start()) + 1
+            yield line_no, " ".join(args.split())[:120]
+
+
+def test_no_dynamic_detail_in_500_responses() -> None:
+    offenders: list[str] = []
+    for path in _backend_python_files():
+        text = path.read_text(encoding="utf-8")
+        for line_no, snippet in _iter_500_dynamic_detail(text):
+            rel = path.relative_to(_BACKEND.parents[2])
+            offenders.append(f"{rel}:{line_no}: HTTPException({snippet})")
+
+    assert not offenders, (
+        "HTTP 500 responses must use a static `detail` string (e.g. "
+        '"Internal server error") and never leak the caught exception. '
+        "Log the full error server-side instead. Offending sites:\n  "
+        + "\n  ".join(offenders)
+    )
+
+
+def test_guard_detects_a_synthetic_leak() -> None:
+    """Sanity check: the scanner actually flags a dynamic 500 detail."""
+    leaky = "raise HTTPException(status_code=500, detail=str(e))"
+    safe = 'raise HTTPException(status_code=500, detail="Internal server error")'
+    client_err = "raise HTTPException(status_code=400, detail=str(exc))"
+
+    assert list(_iter_500_dynamic_detail(leaky)), "scanner missed a real 500 leak"
+    assert not list(
+        _iter_500_dynamic_detail(safe)
+    ), "scanner false-positived a static detail"
+    assert not list(
+        _iter_500_dynamic_detail(client_err)
+    ), "scanner must ignore 4xx responses"
+
+
+if __name__ == "__main__":  # pragma: no cover
+    raise SystemExit(pytest.main([__file__, "-v"]))

From f25030c8715ae1a8e1c4da114a82ea009e7b04d1 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 17 Jul 2026 02:10:00 +0000
Subject: [PATCH 2/6] fix(security): close remaining dict/variable 500
 info-disclosure leaks in cloud/real routers

Follow-up on the merge resolution (4c9b205): three 500 handlers still returned
internal exception text, flagged in the Copilot review but not yet fixed:

- cloud_api_endpoints.py: process_video_cloud returned a dict detail whose
  "message" embedded f"Cloud processing failed: {str(e)}"; process_video_task_handler
  returned detail=error_msg (same interpolation).
- real_api_endpoints.py: process_video_real_api returned a dict detail embedding
  f"Real API processing failed: {str(e)}".

All three now return a static detail="Internal server error". error_msg is still
built and logged server-side via logger.error, so diagnostics are preserved; only
the client-facing body is sanitized. No test asserted the leaked dict/message.

Remaining, still-open items (already noted by the Copilot review, deferred as
separate semantics-touching changes): the JSONResponse global_exception_handler in
backend/main.py, the 503/429 handlers in cloud_ai_routes.py (exception ordering),
positional HTTPException(500, str(e)) sites in api/advanced_video_routes.py, and
upgrading the regression guard to AST so it covers those forms.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MF2xHBKyQBQtpdXt6bVRx
---
 .../backend/cloud_api_endpoints.py                 | 14 ++++----------
 .../backend/real_api_endpoints.py                  | 11 ++---------
 2 files changed, 6 insertions(+), 19 deletions(-)

diff --git a/src/youtube_extension/backend/cloud_api_endpoints.py b/src/youtube_extension/backend/cloud_api_endpoints.py
index 165bc76c9..3963ccb21 100644
--- a/src/youtube_extension/backend/cloud_api_endpoints.py
+++ b/src/youtube_extension/backend/cloud_api_endpoints.py
@@ -145,15 +145,8 @@ async def process_video_cloud(
         error_msg = f"Cloud processing failed: {str(e)}"
         logger.error(error_msg)
 
-        raise HTTPException(
-            status_code=500,
-            detail={
-                "error": "cloud_processing_failed",
-                "message": error_msg,
-                "video_url": request.video_url,
-                "timestamp": datetime.now(timezone.utc).isoformat()
-            }
-        )
+        # detail is a static string; error_msg (with the exception) is logged above only
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 @router.post("/api/v3/process-video-task")
 async def process_video_task_handler(
@@ -229,7 +222,8 @@ async def process_video_task_handler(
         except Exception as state_error:
             logger.error(f"Failed to update error state: {state_error}")
 
-        raise HTTPException(status_code=500, detail=error_msg)
+        # detail is a static string; error_msg (with the exception) is logged above only
+        raise HTTPException(status_code=500, detail="Internal server error")
 
 @router.post("/api/v3/batch-process")
 async def batch_process_videos_cloud(request: BatchCloudProcessingRequest):
diff --git a/src/youtube_extension/backend/real_api_endpoints.py b/src/youtube_extension/backend/real_api_endpoints.py
index 1b0433cfc..8567e9712 100644
--- a/src/youtube_extension/backend/real_api_endpoints.py
+++ b/src/youtube_extension/backend/real_api_endpoints.py
@@ -121,15 +121,8 @@ async def process_video_real_api(request: VideoProcessingRequest, background_tas
             error_msg = f"Real API processing failed: {str(e)}"
             logger.error(error_msg)
 
-            raise HTTPException(
-                status_code=500,
-                detail={
-                    "error": "video_processing_failed",
-                    "message": error_msg,
-                    "video_url": request.video_url,
-                    "timestamp": datetime.now(timezone.utc).isoformat()
-                }
-            )
+            # detail is a static string; error_msg (with the exception) is logged above only
+            raise HTTPException(status_code=500, detail="Internal server error")
 
     @app.post("/api/v2/validate-video")
     async def validate_video_url(request: VideoValidationRequest):

From 321d9632aec2a976b8a7d660fe6b7f15eaf8b386 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 17 Jul 2026 02:19:04 +0000
Subject: [PATCH 3/6] test: assert 500 responses do not leak internal state
 (align with sanitization)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The existing test_error_response_includes_video_url asserted that the
/api/v2/process-video 500 body echoed the request video_url — the exact
CWE-209 information-disclosure behaviour the sanitization removes. It failed
in CI (assert 'auJzb1D-fag' in 'Internal server error') because the handler
now returns a static detail.

Invert it into test_error_response_does_not_leak_internal_state: assert the
detail is exactly 'Internal server error' and contains neither the
video_url nor the exception text.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JNphZoHcSj1jnc3ofnw5oc
---
 tests/unit/test_real_api_endpoints.py | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/tests/unit/test_real_api_endpoints.py b/tests/unit/test_real_api_endpoints.py
index 4eb7109c6..eea820c54 100644
--- a/tests/unit/test_real_api_endpoints.py
+++ b/tests/unit/test_real_api_endpoints.py
@@ -344,14 +344,19 @@ def test_returns_500_when_processor_raises(self, client, mock_processor):
         )
         assert response.status_code == 500
 
-    def test_error_response_includes_video_url(self, client, mock_processor):
+    def test_error_response_does_not_leak_internal_state(self, client, mock_processor):
         mock_processor.process_video = AsyncMock(side_effect=RuntimeError("crash"))
         response = client.post(
             "/api/v2/process-video",
             json={"video_url": "https://youtube.com/watch?v=auJzb1D-fag"},
         )
+        assert response.status_code == 500
+        # 500 responses must not disclose internal state (CWE-209):
+        # neither the request-supplied video_url nor the exception text.
         detail = response.json()["detail"]
-        assert "auJzb1D-fag" in str(detail)
+        assert detail == "Internal server error"
+        assert "auJzb1D-fag" not in str(detail)
+        assert "crash" not in str(detail)
 
     def test_missing_video_url_returns_422(self, client):
         response = client.post("/api/v2/process-video", json={})

From 9a3b957455df53f48eb32cf925dff973e0e46e98 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 17 Jul 2026 02:29:58 +0000
Subject: [PATCH 4/6] fix(api): preserve 4xx HTTPExceptions and full tracebacks
 in sanitized 500 handlers

Addresses CodeRabbit review on the HTTP-500 info-disclosure hardening (PR #814):

- real_api_endpoints.py: add `except HTTPException: raise` ahead of the broad
  `except Exception` in batch_process_videos and search_youtube_videos so the
  explicit 400 guards (>20 videos, >50 results) are no longer masked as 500.
  This was a real regression: the sanitization catch-all swallowed the
  deliberate 4xx responses.
- cloud_ai_routes.py / cloud_api_endpoints.py / real_api_endpoints.py: add
  `exc_info=True` to the 500-path logger.error calls that lacked it, so
  operators keep full server-side tracebacks after sanitizing the client body.
- test_real_api_endpoints.py: tighten the >20-video and >50-result assertions
  from `in (400, 500)` to `== 400`, locking in the fix.

Verification: pytest tests/unit/test_500_info_disclosure.py
tests/unit/test_real_api_endpoints.py -> 82 passed. Lint-neutral (ruff 35 -> 35).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018QkL23nC1aXbwJ99zrbK4p
---
 src/youtube_extension/backend/cloud_ai_routes.py   | 10 +++++-----
 .../backend/cloud_api_endpoints.py                 |  4 ++--
 .../backend/real_api_endpoints.py                  |  8 +++++++-
 tests/unit/test_real_api_endpoints.py              | 14 +++++++-------
 4 files changed, 21 insertions(+), 15 deletions(-)

diff --git a/src/youtube_extension/backend/cloud_ai_routes.py b/src/youtube_extension/backend/cloud_ai_routes.py
index 0172e1617..a470cabe6 100644
--- a/src/youtube_extension/backend/cloud_ai_routes.py
+++ b/src/youtube_extension/backend/cloud_ai_routes.py
@@ -228,7 +228,7 @@ async def get_provider_status():
             )
 
     except Exception as e:
-        logger.error(f"Failed to get provider status: {e}")
+        logger.error(f"Failed to get provider status: {e}", exc_info=True)
         raise HTTPException(status_code=500, detail="Internal server error")
 
 
@@ -262,12 +262,12 @@ async def analyze_video(request: VideoAnalysisRequest):
         logger.warning(f"Rate limit exceeded: {e}")
         raise HTTPException(status_code=429, detail=f"Rate limit exceeded: {str(e)}")
     except ConfigurationError as e:
-        logger.error(f"Configuration error: {e}")
+        logger.error(f"Configuration error: {e}", exc_info=True)
         raise HTTPException(status_code=500, detail="Internal server error")
     except HTTPException:
         raise
     except Exception as e:
-        logger.error(f"Unexpected error during video analysis: {e}")
+        logger.error(f"Unexpected error during video analysis: {e}", exc_info=True)
         raise HTTPException(status_code=500, detail="Internal server error")
 
 
@@ -300,7 +300,7 @@ async def analyze_batch_videos(request: BatchAnalysisRequest, background_tasks:
     except HTTPException:
         raise
     except Exception as e:
-        logger.error(f"Failed to start batch analysis: {e}")
+        logger.error(f"Failed to start batch analysis: {e}", exc_info=True)
         raise HTTPException(status_code=500, detail="Internal server error")
 
 
@@ -324,7 +324,7 @@ async def analyze_video_multi_provider(request: VideoAnalysisRequest):
             return formatted_results
 
     except Exception as e:
-        logger.error(f"Multi-provider analysis failed: {e}")
+        logger.error(f"Multi-provider analysis failed: {e}", exc_info=True)
         raise HTTPException(status_code=500, detail="Internal server error")
 
 
diff --git a/src/youtube_extension/backend/cloud_api_endpoints.py b/src/youtube_extension/backend/cloud_api_endpoints.py
index 3963ccb21..e1da6f629 100644
--- a/src/youtube_extension/backend/cloud_api_endpoints.py
+++ b/src/youtube_extension/backend/cloud_api_endpoints.py
@@ -143,7 +143,7 @@ async def process_video_cloud(
 
     except Exception as e:
         error_msg = f"Cloud processing failed: {str(e)}"
-        logger.error(error_msg)
+        logger.error(error_msg, exc_info=True)
 
         # detail is a static string; error_msg (with the exception) is logged above only
         raise HTTPException(status_code=500, detail="Internal server error")
@@ -209,7 +209,7 @@ async def process_video_task_handler(
 
     except Exception as e:
         error_msg = f"Task processing failed: {str(e)}"
-        logger.error(error_msg)
+        logger.error(error_msg, exc_info=True)
 
         # Update state with error
         try:
diff --git a/src/youtube_extension/backend/real_api_endpoints.py b/src/youtube_extension/backend/real_api_endpoints.py
index 8567e9712..a810032ae 100644
--- a/src/youtube_extension/backend/real_api_endpoints.py
+++ b/src/youtube_extension/backend/real_api_endpoints.py
@@ -119,7 +119,7 @@ async def process_video_real_api(request: VideoProcessingRequest, background_tas
 
         except Exception as e:
             error_msg = f"Real API processing failed: {str(e)}"
-            logger.error(error_msg)
+            logger.error(error_msg, exc_info=True)
 
             # detail is a static string; error_msg (with the exception) is logged above only
             raise HTTPException(status_code=500, detail="Internal server error")
@@ -170,6 +170,9 @@ async def batch_process_videos(request: BatchProcessingRequest):
 
             return result
 
+        except HTTPException:
+            # Preserve explicit 4xx responses (e.g. the 400 batch-size guard above).
+            raise
         except Exception as e:
             logger.error(f"Unhandled error in batch_process_videos: {e}", exc_info=True)
             raise HTTPException(
@@ -428,6 +431,9 @@ async def search_youtube_videos(
                 "timestamp": datetime.now(timezone.utc).isoformat()
             }
 
+        except HTTPException:
+            # Preserve explicit 4xx responses (e.g. the 400 max-results guard above).
+            raise
         except Exception as e:
             logger.error(f"Unhandled error in search_youtube_videos: {e}", exc_info=True)
             raise HTTPException(
diff --git a/tests/unit/test_real_api_endpoints.py b/tests/unit/test_real_api_endpoints.py
index eea820c54..fdadef769 100644
--- a/tests/unit/test_real_api_endpoints.py
+++ b/tests/unit/test_real_api_endpoints.py
@@ -442,15 +442,15 @@ def test_valid_batch_returns_200(self, client):
         assert response.status_code == 200
 
     def test_batch_with_more_than_20_videos_returns_error(self, client):
-        """Source code raises HTTPException(400) inside a try block that
-        re-wraps it as 500. Test matches actual behaviour."""
+        """The >20-video guard raises HTTPException(400); an ``except HTTPException:
+        raise`` ahead of the broad handler preserves it instead of masking it as 500."""
         urls = [f"https://youtube.com/watch?v=vid{i:05d}" for i in range(21)]
         response = client.post(
             "/api/v2/batch-process",
             json={"video_urls": urls, "max_concurrent": 3},
         )
-        # The HTTPException(400) is caught by the outer except -> HTTP 500
-        assert response.status_code in (400, 500)
+        # The explicit 400 must survive the outer exception handler.
+        assert response.status_code == 400
 
     def test_batch_response_contains_results(self, client):
         response = client.post(
@@ -802,10 +802,10 @@ def test_result_video_url_format(self, client):
         assert "youtube.com/watch?v=" in result["video_url"]
 
     def test_max_results_above_50_returns_error(self, client):
-        """Source code raises HTTPException(400) inside a try block that
-        catches Exception -> results in HTTP 500."""
+        """The >50-results guard raises HTTPException(400); an ``except HTTPException:
+        raise`` ahead of the broad handler preserves it instead of masking it as 500."""
         response = client.post("/api/v2/search-videos?query=python&max_results=51")
-        assert response.status_code in (400, 500)
+        assert response.status_code == 400
 
     def test_default_order_is_relevance(self, client, mock_youtube):
         client.post("/api/v2/search-videos?query=test")

From 4cee0addb7cd3271b3b018d7c408fe561736a8ed Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 17 Jul 2026 04:05:23 +0000
Subject: [PATCH 5/6] fix(security): close global 500 handler leak, fix
 unreachable handlers, harden guard
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Addresses the Copilot review on #816:

- backend/main.py: the global @app.exception_handler(Exception) returned a
  JSONResponse(500) leaking str(exc), the request URL, and exc.__class__.__name__
  to clients (CWE-209) — the single highest-volume 500 path, since it catches
  every unhandled exception. Now returns a static body; the full exception and
  path are logged server-side via exc_info=True.
- cloud_ai_routes.py analyze_video: RateLimitError and ConfigurationError
  subclass CloudAIError, so `except CloudAIError` shadowed both specialized
  handlers (dead code). Reordered so the subclasses are caught first —
  ConfigurationError now reaches the sanitized 500 and RateLimitError returns
  429 as intended instead of a 503.
- test_500_info_disclosure.py: replaced the regex guard (which only caught
  str()/f-string HTTPException details) with an AST guard that is leak-shape
  complete. HTTPException 500 detail must be a static string literal (catches
  bare-variable and dict details too); JSONResponse 500 bodies are flagged when
  they reference the exception/request (catches the global handler) while safe
  dynamic values — a uuid4 error id, an isoformat timestamp — are allowed, so
  the middleware fallback handler is correctly not flagged. Added positive and
  negative controls for every shape.

Verification: pytest tests/unit/test_500_info_disclosure.py
tests/unit/test_real_api_endpoints.py -> 83 passed. Lint-neutral (ruff 22 -> 22).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018QkL23nC1aXbwJ99zrbK4p
---
 .../backend/cloud_ai_routes.py                |  10 +-
 src/youtube_extension/backend/main.py         |  34 +--
 tests/unit/test_500_info_disclosure.py        | 200 ++++++++++++------
 3 files changed, 165 insertions(+), 79 deletions(-)

diff --git a/src/youtube_extension/backend/cloud_ai_routes.py b/src/youtube_extension/backend/cloud_ai_routes.py
index a470cabe6..cdfe3f3ad 100644
--- a/src/youtube_extension/backend/cloud_ai_routes.py
+++ b/src/youtube_extension/backend/cloud_ai_routes.py
@@ -255,15 +255,19 @@ async def analyze_video(request: VideoAnalysisRequest):
             # Format and return response
             return format_analysis_result(result)
 
-    except CloudAIError as e:
-        logger.error(f"Cloud AI analysis failed: {e}")
-        raise HTTPException(status_code=503, detail=f"AI analysis failed: {str(e)}")
     except RateLimitError as e:
+        # Must precede CloudAIError: RateLimitError subclasses it, so catching
+        # the base first would shadow this handler and return a 503 instead.
         logger.warning(f"Rate limit exceeded: {e}")
         raise HTTPException(status_code=429, detail=f"Rate limit exceeded: {str(e)}")
     except ConfigurationError as e:
+        # Must precede CloudAIError (same subclassing reason) so configuration
+        # failures reach this sanitized 500 rather than the dynamic 503 below.
         logger.error(f"Configuration error: {e}", exc_info=True)
         raise HTTPException(status_code=500, detail="Internal server error")
+    except CloudAIError as e:
+        logger.error(f"Cloud AI analysis failed: {e}")
+        raise HTTPException(status_code=503, detail=f"AI analysis failed: {str(e)}")
     except HTTPException:
         raise
     except Exception as e:
diff --git a/src/youtube_extension/backend/main.py b/src/youtube_extension/backend/main.py
index ff1234740..c1e59ca5d 100644
--- a/src/youtube_extension/backend/main.py
+++ b/src/youtube_extension/backend/main.py
@@ -444,22 +444,26 @@ async def value_error_handler(request, exc):
 
 @app.exception_handler(Exception)
 async def global_exception_handler(request, exc):
-    """Global exception handler with enhanced error details"""
-    logger.error(f"Unhandled exception: {exc}", exc_info=True)
-
-    error_detail = {
-        "error": "Internal server error",
-        "detail": str(exc),
-        "timestamp": datetime.now().isoformat(),
-        "path": str(request.url) if hasattr(request, "url") else "unknown",
-        "version": "2.0.0",
-        "architecture": "service-oriented",
-    }
-
-    if hasattr(exc, "__class__"):
-        error_detail["error_type"] = exc.__class__.__name__
+    """Global exception handler.
+
+    The full exception (type, message, traceback) and the request path are
+    logged server-side only. The client receives a static body so an unhandled
+    error cannot disclose internal details — exception text, exception type, or
+    the request URL (CWE-209).
+    """
+    path = str(request.url) if hasattr(request, "url") else "unknown"
+    logger.error(
+        f"Unhandled exception on {path}: {exc}", exc_info=True
+    )
 
-    return JSONResponse(status_code=500, content=error_detail)
+    return JSONResponse(
+        status_code=500,
+        content={
+            "error": "Internal server error",
+            "detail": "Internal server error",
+            "timestamp": datetime.now().isoformat(),
+        },
+    )
 
 
 # Application lifecycle events
diff --git a/tests/unit/test_500_info_disclosure.py b/tests/unit/test_500_info_disclosure.py
index d561c422e..95ba547b7 100644
--- a/tests/unit/test_500_info_disclosure.py
+++ b/tests/unit/test_500_info_disclosure.py
@@ -1,93 +1,171 @@
 """Regression guard against information disclosure in HTTP 500 responses.
 
-Context: several FastAPI handlers historically raised
-``HTTPException(status_code=500, detail=str(e))`` (or an f-string embedding the
-exception), leaking internal exception text — stack-adjacent messages, backend
-API errors, database errors — to clients. See PR #801, which sanitized most but
-not all handlers.
-
-This test encodes the invariant directly on the source: a 500 response must use
-a *static* ``detail`` string, never one derived from the caught exception. It is
-hermetic (pure source scan, no app import / no pydantic) so it runs anywhere and
-catches new leaks in any backend route, not just the ones fixed today.
+Context: several FastAPI handlers historically returned internal exception text
+to clients via 500 responses (CWE-209) — through ``HTTPException`` details and
+through ``JSONResponse`` bodies raised by global/middleware exception handlers.
+Leaked shapes seen in this codebase:
+
+* ``raise HTTPException(status_code=500, detail=str(e))``
+* ``raise HTTPException(status_code=500, detail=f"... {e} ...")``
+* ``raise HTTPException(status_code=500, detail=error_msg)``            (variable)
+* ``raise HTTPException(status_code=500, detail={"message": error_msg})``  (dict)
+* ``JSONResponse(status_code=500, content={"detail": str(exc),
+  "path": str(request.url), "error_type": exc.__class__.__name__})``
+
+This test encodes the invariant directly on the source (a pure AST scan — no app
+import, no pydantic) so it runs anywhere and catches new leaks in *any* backend
+route, global handler, or middleware, not only the ones fixed today. It covers
+both 500 response constructors: ``HTTPException`` and ``JSONResponse``.
+
+Rules:
+
+* ``HTTPException(status_code=500, ...)``: ``detail`` must be an inline static
+  string literal. Anything else — ``str(...)``, an f-string, a bare variable, a
+  dict — is rejected (a 500 detail never legitimately needs to be computed).
+* ``JSONResponse(status_code=500, ...)``: the ``content`` (or ``detail``) must
+  not reference the caught exception or the request. A ``str(exc)`` / ``repr``,
+  an f-string embedding the exception/request, a bare ``exc``/``e``/``error``
+  name, or an attribute such as ``request.url`` / ``exc.__class__`` is rejected.
+  Safe dynamic values — a ``uuid4()`` error id, a ``datetime.now().isoformat()``
+  timestamp — are intentionally allowed.
 
 It deliberately does not constrain 4xx responses: those echo client-supplied
-validation errors, which are not internal-disclosure vectors.
+validation input, which is not an internal-disclosure vector.
 """
 
 from __future__ import annotations
 
-import re
+import ast
 from pathlib import Path
 
 import pytest
 
 _BACKEND = Path(__file__).resolve().parents[2] / "src" / "youtube_extension" / "backend"
 
-# Match a single `raise HTTPException(...)` call, capturing its argument list,
-# tolerant of the call spanning multiple lines.
-_HTTP_EXC = re.compile(r"HTTPException\((?P<args>.*?)\)", re.DOTALL)
-
-# A `detail=` argument whose value is derived from a variable/exception:
-#   detail=str(e)              detail=str(exc)
-#   detail=f"... {e} ..."      detail=f"... {str(e)} ..."
-_DYNAMIC_DETAIL = re.compile(
-    r"""detail\s*=\s*(?:
-        str\(                         # detail=str(...)
-      | f["'][^"']*\{                 # detail=f"...{...}..."
-    )""",
-    re.VERBOSE,
-)
+# Identifiers that, when referenced inside a 500 body, indicate a leak of the
+# caught exception or the inbound request.
+_EXC_NAMES = {"e", "exc", "err", "error", "ex", "exception"}
+_REQUEST_NAMES = {"request", "req"}
+# Attributes that disclose internals when reached from an exception/request.
+_LEAKY_ATTRS = {"url", "__class__", "args", "__cause__", "__context__"}
+
+
+def _is_static_string(node: ast.AST) -> bool:
+    """True iff *node* is an inline string literal (optionally concatenated)."""
+    if isinstance(node, ast.Constant):
+        return isinstance(node.value, str)
+    # "a" "b" implicit concat / "a" + "b"
+    if isinstance(node, ast.BinOp) and isinstance(node.op, ast.Add):
+        return _is_static_string(node.left) and _is_static_string(node.right)
+    return False
+
+
+def _refs_exception_or_request(node: ast.AST) -> bool:
+    """True if *node*'s subtree reads the caught exception or the request."""
+    for leaf in ast.walk(node):
+        if isinstance(leaf, ast.Name) and leaf.id in (_EXC_NAMES | _REQUEST_NAMES):
+            return True
+        if isinstance(leaf, ast.Attribute):
+            if leaf.attr in _LEAKY_ATTRS:
+                return True
+            base = leaf.value
+            if isinstance(base, ast.Name) and base.id in (_EXC_NAMES | _REQUEST_NAMES):
+                return True
+        if isinstance(leaf, ast.Call):
+            fn = leaf.func
+            if isinstance(fn, ast.Name) and fn.id in {"str", "repr", "format"}:
+                if any(_refs_exception_or_request(a) for a in leaf.args):
+                    return True
+    return False
+
+
+def _status_is_500(call: ast.Call) -> bool:
+    for kw in call.keywords:
+        if kw.arg == "status_code" and isinstance(kw.value, ast.Constant):
+            return kw.value.value == 500
+    # positional status_code (JSONResponse(500, ...) / HTTPException(500, ...))
+    if call.args and isinstance(call.args[0], ast.Constant):
+        return call.args[0].value == 500
+    return False
+
+
+def _call_name(call: ast.Call) -> str | None:
+    fn = call.func
+    return getattr(fn, "id", None) or getattr(fn, "attr", None)
+
+
+def _iter_500_leaks(text: str):
+    """Yield (line_no, reason) for each 500 response that can leak internals."""
+    tree = ast.parse(text)
+    for node in ast.walk(tree):
+        if not isinstance(node, ast.Call):
+            continue
+        name = _call_name(node)
+        if name not in ("HTTPException", "JSONResponse"):
+            continue
+        if not _status_is_500(node):
+            continue
+        for kw in node.keywords:
+            if name == "HTTPException" and kw.arg == "detail":
+                if not _is_static_string(kw.value):
+                    yield node.lineno, "HTTPException 500 detail is not a static string"
+            elif name == "JSONResponse" and kw.arg in ("content", "detail"):
+                if _refs_exception_or_request(kw.value):
+                    yield node.lineno, "JSONResponse 500 body references the exception/request"
 
 
 def _backend_python_files() -> list[Path]:
     return sorted(_BACKEND.rglob("*.py"))
 
 
-def _iter_500_dynamic_detail(text: str):
-    """Yield (line_no, snippet) for each 500 HTTPException with a dynamic detail."""
-    for m in _HTTP_EXC.finditer(text):
-        args = m.group("args")
-        if "status_code=500" not in args.replace(" ", "").replace(
-            "status_code =", "status_code="
-        ):
-            # normalize minor spacing; only care about 500 responses
-            if "status_code=500" not in re.sub(r"\s+", "", args):
-                continue
-        if _DYNAMIC_DETAIL.search(args):
-            line_no = text.count("\n", 0, m.start()) + 1
-            yield line_no, " ".join(args.split())[:120]
-
-
-def test_no_dynamic_detail_in_500_responses() -> None:
+def test_no_information_disclosure_in_500_responses() -> None:
     offenders: list[str] = []
     for path in _backend_python_files():
         text = path.read_text(encoding="utf-8")
-        for line_no, snippet in _iter_500_dynamic_detail(text):
+        try:
+            leaks = list(_iter_500_leaks(text))
+        except SyntaxError as exc:  # pragma: no cover - source is valid Python
+            raise AssertionError(f"could not parse {path}: {exc}") from exc
+        for line_no, reason in leaks:
             rel = path.relative_to(_BACKEND.parents[2])
-            offenders.append(f"{rel}:{line_no}: HTTPException({snippet})")
+            offenders.append(f"{rel}:{line_no}: {reason}")
 
     assert not offenders, (
-        "HTTP 500 responses must use a static `detail` string (e.g. "
-        '"Internal server error") and never leak the caught exception. '
-        "Log the full error server-side instead. Offending sites:\n  "
-        + "\n  ".join(offenders)
+        "HTTP 500 responses must not disclose internal details. Use a static "
+        '"Internal server error" body and log the full exception server-side '
+        "instead. Offending sites:\n  " + "\n  ".join(offenders)
     )
 
 
-def test_guard_detects_a_synthetic_leak() -> None:
-    """Sanity check: the scanner actually flags a dynamic 500 detail."""
-    leaky = "raise HTTPException(status_code=500, detail=str(e))"
-    safe = 'raise HTTPException(status_code=500, detail="Internal server error")'
-    client_err = "raise HTTPException(status_code=400, detail=str(exc))"
-
-    assert list(_iter_500_dynamic_detail(leaky)), "scanner missed a real 500 leak"
-    assert not list(
-        _iter_500_dynamic_detail(safe)
-    ), "scanner false-positived a static detail"
-    assert not list(
-        _iter_500_dynamic_detail(client_err)
-    ), "scanner must ignore 4xx responses"
+def test_guard_detects_every_known_leak_shape() -> None:
+    """Positive controls: the scanner flags each historical leak shape."""
+    leaky_samples = [
+        'raise HTTPException(status_code=500, detail=str(e))',
+        'raise HTTPException(status_code=500, detail=f"boom: {e}")',
+        'raise HTTPException(status_code=500, detail=error_msg)',
+        'raise HTTPException(status_code=500, detail={"message": error_msg})',
+        'return JSONResponse(status_code=500, content={"detail": str(exc)})',
+        'return JSONResponse(status_code=500, content={"path": str(request.url)})',
+        'return JSONResponse(status_code=500, content={"t": exc.__class__.__name__})',
+    ]
+    for sample in leaky_samples:
+        assert list(_iter_500_leaks(sample)), f"scanner missed a real leak: {sample}"
+
+
+def test_guard_allows_sanitized_and_safe_dynamic_bodies() -> None:
+    """Negative controls: static bodies and safe dynamic values are allowed."""
+    safe_samples = [
+        'raise HTTPException(status_code=500, detail="Internal server error")',
+        # 4xx echoing client input is out of scope.
+        'raise HTTPException(status_code=400, detail=str(exc))',
+        # A random error id + timestamp is not an internal-disclosure vector.
+        'return JSONResponse(status_code=500, content={'
+        '"id": f"FALLBACK_{uuid.uuid4().hex}", '
+        '"message": "An unexpected error occurred.", '
+        '"timestamp": datetime.now().isoformat()})',
+    ]
+    for sample in safe_samples:
+        assert not list(_iter_500_leaks(sample)), f"scanner false-positived: {sample}"
 
 
 if __name__ == "__main__":  # pragma: no cover

From 06fa2ada44211f5abde898b616735259ff510614 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 17 Jul 2026 04:14:03 +0000
Subject: [PATCH 6/6] test(main): assert global 500 handler does not leak; keep
 static version metadata
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CI regression from the previous commit: two tests in test_backend_main.py
asserted the pre-sanitization global-handler body.

- test_global_exception_handler_includes_error_type asserted the handler
  exposes exc.__class__.__name__ — the exact CWE-209 leak this PR removes.
  Rewrote it as test_global_exception_handler_does_not_leak_internal_details:
  the 500 body must not contain the exception class, message, or request URL.
- test_global_exception_handler_includes_version expects the static
  "version" field. That field (and "architecture") is non-sensitive app
  metadata, not exception-derived, so I restored both to the handler rather
  than dropping them — only the leaking fields (str(exc), request URL,
  error_type) are removed from the client body; the path is still logged.

Verification: hermetic guard (test_500_info_disclosure.py) -> 3 passed; the
handler now satisfies both updated assertions (verified in isolation).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018QkL23nC1aXbwJ99zrbK4p
---
 src/youtube_extension/backend/main.py |  2 ++
 tests/unit/test_backend_main.py       | 21 +++++++++++++++++----
 2 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/src/youtube_extension/backend/main.py b/src/youtube_extension/backend/main.py
index c1e59ca5d..46c22faf9 100644
--- a/src/youtube_extension/backend/main.py
+++ b/src/youtube_extension/backend/main.py
@@ -462,6 +462,8 @@ async def global_exception_handler(request, exc):
             "error": "Internal server error",
             "detail": "Internal server error",
             "timestamp": datetime.now().isoformat(),
+            "version": "2.0.0",
+            "architecture": "service-oriented",
         },
     )
 
diff --git a/tests/unit/test_backend_main.py b/tests/unit/test_backend_main.py
index a73dcf792..20cfc21db 100644
--- a/tests/unit/test_backend_main.py
+++ b/tests/unit/test_backend_main.py
@@ -590,14 +590,27 @@ async def test_global_exception_handler_returns_500(self):
         response = await main_module.global_exception_handler(mock_req, RuntimeError("crash"))
         assert response.status_code == 500
 
-    async def test_global_exception_handler_includes_error_type(self):
+    async def test_global_exception_handler_does_not_leak_internal_details(self):
+        """The 500 body must not disclose the exception (message or class) or the
+        request URL (CWE-209); those go to the server log only."""
         import json as _json
 
         mock_req = MagicMock()
-        mock_req.url = "http://test/api"
-        response = await main_module.global_exception_handler(mock_req, RuntimeError("crash"))
+        mock_req.url = "http://test/api/secret-path"
+        response = await main_module.global_exception_handler(
+            mock_req, RuntimeError("crash: db password = hunter2")
+        )
         body = _json.loads(response.body)
-        assert body["error_type"] == "RuntimeError"
+        # No exception class name, exception message, or request URL in the body.
+        assert "error_type" not in body
+        serialized = _json.dumps(body)
+        assert "RuntimeError" not in serialized
+        assert "crash" not in serialized
+        assert "hunter2" not in serialized
+        assert "secret-path" not in serialized
+        # Static, non-sensitive fields remain.
+        assert body["error"] == "Internal server error"
+        assert body["detail"] == "Internal server error"
 
     async def test_global_exception_handler_includes_version(self):
         import json as _json