fix(security): restore CWE-209 response protections

src/agents/specialized/code_generator.py

@@ -22,6 +22,10 @@ def _load_templates(self) -> dict[str, str]:
         return {
             "fastapi_endpoint": textwrap.dedent(
                 """
+                import logging
+
+                logger = logging.getLogger(__name__)
+
                 @app.post("/api/v1/{endpoint_name}")
                 async def {function_name}({parameters}):
                     \"\"\"
@@ -42,8 +46,12 @@ async def {function_name}({parameters}):
                         }}
                     except ValidationError as e:
                         raise HTTPException(status_code=400, detail=str(e))
-                    except Exception as e:
-                        raise HTTPException(status_code=500, detail=str(e))
+                    except Exception:
+                        logger.exception("Generated endpoint failed")
+                        raise HTTPException(
+                            status_code=500,
+                            detail="Internal server error",
+                        )
             """
             ),
             "rest_api": textwrap.dedent(

src/youtube_extension/backend/cloud_ai_routes.py

@@ -259,7 +259,7 @@ async def analyze_video(request: VideoAnalysisRequest):
         # Must precede CloudAIError: RateLimitError subclasses it, so catching
         # the base first would shadow this handler and return a 503 instead.
         logger.warning(f"Rate limit exceeded: {e}")
-        raise HTTPException(status_code=429, detail=f"Rate limit exceeded: {str(e)}")
+        raise HTTPException(status_code=429, detail="Rate limit exceeded")
     except ConfigurationError as e:
         # Must precede CloudAIError (same subclassing reason) so configuration
         # failures reach this sanitized 500 rather than the dynamic 503 below.

src/youtube_extension/backend/cloud_api_endpoints.py

@@ -35,6 +35,50 @@
 router = APIRouter()
 
 
+def _client_safe_error(error_message: Any) -> Optional[str]:
+    """Return a stable client-safe value for persisted processor failures.
+
+    Older Firestore records may predate the write-side sanitizer, so every read
+    boundary must treat stored error text as untrusted rather than echoing it.
+    """
+    return "Internal server error" if error_message else None
+
+
+def _sanitize_error_list(value: Any) -> Any:
+    """Replace scalar diagnostic entries while preserving structured shapes."""
+    if isinstance(value, list):
+        return [_sanitize_error_list(item) for item in value]
+    if isinstance(value, tuple):
+        return tuple(_sanitize_error_list(item) for item in value)
+    if isinstance(value, dict):
+        return _sanitize_response_errors(value)
+    # Every remaining leaf is a scalar diagnostic. Only ``None`` (absence of an
+    # error) is preserved; any other non-null leaf — including non-string types
+    # such as bytes, ints, or bools that FastAPI can still serialize — is
+    # replaced so it cannot bypass the scalar sanitization invariant.
+    if value is None:
+        return None
+    return "Internal server error"
+
+
+def _sanitize_response_errors(value: Any) -> Any:
+    """Copy a client response tree and remove persisted diagnostic messages."""
+    if isinstance(value, dict):
+        sanitized: Dict[Any, Any] = {}
+        for key, item in value.items():
+            if key in {"error", "error_message"}:
+                sanitized[key] = _client_safe_error(item)
+            elif key == "errors":
+                sanitized[key] = _sanitize_error_list(item)
+            else:
+                sanitized[key] = _sanitize_response_errors(item)
+        return sanitized
+    if isinstance(value, list):
+        return [_sanitize_response_errors(item) for item in value]
+    if isinstance(value, tuple):
+        return tuple(_sanitize_response_errors(item) for item in value)
+    return value
+
 
 # Pydantic models for API requests/responses
 class CloudVideoProcessingRequest(BaseModel):
@@ -133,12 +177,12 @@ async def process_video_cloud(
                 video_url=result.video_url,
                 success=result.success,
                 status='completed' if result.success else 'failed',
-                metadata=result.metadata,
-                transcript=result.transcript,
-                ai_analysis=result.ai_analysis,
+                metadata=_sanitize_response_errors(result.metadata),
+                transcript=_sanitize_response_errors(result.transcript),
+                ai_analysis=_sanitize_response_errors(result.ai_analysis),
                 processing_time=result.processing_time,
                 from_cache=result.from_cache,
-                error=result.error_message,
+                error=_client_safe_error(result.error_message),
             )
 
     except Exception as e:
@@ -218,8 +262,8 @@ async def process_video_task_handler(
                 status='failed',
                 error_message="Task processing failed"
             )
-        except Exception as state_error:
-            logger.error(f"Failed to update error state: {state_error}")
+        except Exception:
+            logger.error("Failed to update error state", exc_info=True)
 
         raise HTTPException(status_code=500, detail="Internal server error")
 
@@ -280,7 +324,7 @@ async def get_video_status(video_id: str):
             created_at=state.created_at,
             updated_at=state.updated_at,
             processing_time=state.processing_time,
-            error_message=state.error_message,
+            error_message=_client_safe_error(state.error_message),
         )
 
     except HTTPException:
@@ -312,13 +356,13 @@ async def get_video_result(video_id: str):
             "video_url": state.video_url,
             "status": state.status,
             "current_stage": state.current_stage,
-            "metadata": state.metadata,
-            "transcript": state.transcript,
-            "ai_analysis": state.ai_analysis,
+            "metadata": _sanitize_response_errors(state.metadata),
+            "transcript": _sanitize_response_errors(state.transcript),
+            "ai_analysis": _sanitize_response_errors(state.ai_analysis),
             "processing_time": state.processing_time,
             "created_at": state.created_at,
             "updated_at": state.updated_at,
-            "error_message": state.error_message,
+            "error_message": _client_safe_error(state.error_message),
         }
 
     except HTTPException:
@@ -345,11 +389,11 @@ async def get_queue_stats():
             "timestamp": datetime.now(timezone.utc).isoformat(),
         }
 
-    except Exception as e:
-        logger.error(f"Error getting queue stats: {e}")
+    except Exception:
+        logger.error("Error getting queue stats", exc_info=True)
         return {
             "success": False,
-            "error": str(e),
+            "error": "Internal server error",
             "timestamp": datetime.now(timezone.utc).isoformat(),
         }
 
@@ -372,10 +416,11 @@ async def get_cloud_status():
                 "status": "operational",
                 "enabled": True,
             }
-        except Exception as e:
+        except Exception:
+            logger.error("firestore status check failed", exc_info=True)
             status["services"]["firestore"] = {
                 "status": "error",
-                "error": str(e),
+                "error": "Service unavailable",
             }
             status["overall_status"] = "degraded"
 
@@ -388,10 +433,11 @@ async def get_cloud_status():
                 "enabled": True,
                 "queue_stats": stats,
             }
-        except Exception as e:
+        except Exception:
+            logger.error("cloud_tasks status check failed", exc_info=True)
             status["services"]["cloud_tasks"] = {
                 "status": "error",
-                "error": str(e),
+                "error": "Service unavailable",
             }
             status["overall_status"] = "degraded"
 
@@ -402,20 +448,21 @@ async def get_cloud_status():
                 "status": "operational",
                 "enabled": True,
             }
-        except Exception as e:
+        except Exception:
+            logger.error("vertex_ai status check failed", exc_info=True)
             status["services"]["vertex_ai"] = {
                 "status": "error",
-                "error": str(e),
+                "error": "Service unavailable",
             }
             status["overall_status"] = "degraded"
 
         return status
 
-    except Exception as e:
-        logger.error(f"Error getting cloud status: {e}")
+    except Exception:
+        logger.error("Error getting cloud status", exc_info=True)
         return {
             "overall_status": "error",
-            "error": str(e),
+            "error": "Internal server error",
             "timestamp": datetime.now(timezone.utc).isoformat(),
         }