fix: guard error stringification in the invoke and precheck handlers

str() on a plugin-raised error can itself raise, replacing the sanitized
envelope with a raw HTTP 500 that the controller's preflight treats as
fail-open.

Author: CyMule

test/api/test_api.py

@@ -674,6 +674,43 @@ def _raising_func() -> None:
     assert "original message" in body["status_code_text"]
 
 
+class _UnrenderableError(Exception):
+    status_code = 403
+
+    def __str__(self) -> str:
+        raise RuntimeError("__str__ exploded")
+
+
+def test_invoke_survives_error_whose_str_raises():
+    def _raising_func() -> None:
+        raise _UnrenderableError()
+
+    client = TestClient(wrap_in_fastapi(func=_raising_func, plugin_id="mock_plugin"))
+
+    resp = client.post("/invoke")
+    assert resp.status_code == 200
+    body = resp.json()
+    assert body["status_code"] == 403
+    assert "<unrenderable error>" in body["status_code_text"]
+
+
+def test_precheck_survives_error_whose_str_raises():
+    def _unrenderable_precheck() -> None:
+        raise _UnrenderableError()
+
+    client = TestClient(
+        wrap_in_fastapi(
+            func=_no_params, plugin_id="mock_plugin", precheck_func=_unrenderable_precheck
+        )
+    )
+
+    resp = client.get("/precheck")
+    assert resp.status_code == 200
+    body = resp.json()
+    assert body["status_code"] == 403
+    assert "<unrenderable error>" in body["status_code_text"]
+
+
 def test_invoke_ignores_non_integer_status_code():
     class _BadStatusError(Exception):
         status_code = "not-a-code"

unstructured_platform_plugins/etl_uvicorn/api_generator.py

@@ -74,6 +74,19 @@ def _error_attr(error: BaseException, name: str) -> Any:
         return None
 
 
+def _safe_str(value: object) -> str:
+    """str() on a plugin-supplied error can itself raise; never let that escape the handler.
+
+    An escape replaces the sanitized envelope with a raw HTTP 500, which the
+    controller's preflight reads as fail-open — a plugin-reported failure would
+    silently become a proceed.
+    """
+    try:
+        return str(value)
+    except Exception:
+        return "<unrenderable error>"
+
+
 def failure_category_of(error: BaseException) -> Optional[str]:
     """Return the error's failure_category only when it is a plain string."""
     category = _error_attr(error, "failure_category")
@@ -231,7 +244,7 @@ async def _stream_response():
                                 + "\n"
                             )
                     except Exception as e:
-                        logger.error(f"Failure streaming response: {e}", exc_info=True)
+                        logger.error(f"Failure streaming response: {_safe_str(e)}", exc_info=True)
                         yield (
                             InvokeResponse(
                                 usage=usage,
@@ -240,7 +253,7 @@ async def _stream_response():
                                     filedata_meta.model_dump()
                                 ),
                                 status_code=status_code_of(e),
-                                status_code_text=f"[{e.__class__.__name__}] {e}",
+                                status_code_text=f"[{e.__class__.__name__}] {_safe_str(e)}",
                                 failure_category=failure_category_of(e),
                             ).model_dump_json()
                             + "\n"
@@ -259,7 +272,8 @@ async def _stream_response():
                 )
         except HTTPException as exc:
             logger.error(
-                f"HTTPException: {exc.detail} (status_code={exc.status_code})", exc_info=True
+                f"HTTPException: {_safe_str(exc.detail)} (status_code={exc.status_code})",
+                exc_info=True,
             )
             return InvokeResponse(
                 usage=usage,
@@ -268,13 +282,13 @@ async def _stream_response():
                 status_code=exc.status_code,
                 status_code_text=exc.detail
                 if isinstance(exc.detail, str)
-                else json.dumps(exc.detail, default=str),
+                else json.dumps(exc.detail, default=_safe_str),
                 failure_category=failure_category_of(exc),
                 file_data=request_dict.get("file_data", None),
             )
         except UnstructuredIngestError as exc:
             logger.error(
-                f"UnstructuredIngestError: {exc} "
+                f"UnstructuredIngestError: {_safe_str(exc)} "
                 f"(status_code={_error_attr(exc, 'status_code')})",
                 exc_info=True,
             )
@@ -283,18 +297,18 @@ async def _stream_response():
                 message_channels=message_channels,
                 filedata_meta=filedata_meta_model.model_validate(filedata_meta.model_dump()),
                 status_code=status_code_of(exc),
-                status_code_text=str(exc),
+                status_code_text=_safe_str(exc),
                 failure_category=failure_category_of(exc),
                 file_data=request_dict.get("file_data", None),
             )
         except Exception as invoke_error:
-            logger.error(f"failed to invoke plugin: {invoke_error}", exc_info=True)
+            logger.error(f"failed to invoke plugin: {_safe_str(invoke_error)}", exc_info=True)
             return InvokeResponse(
                 usage=usage,
                 message_channels=message_channels,
                 filedata_meta=filedata_meta_model.model_validate(filedata_meta.model_dump()),
                 status_code=status_code_of(invoke_error),
-                status_code_text=f"[{invoke_error.__class__.__name__}] {invoke_error}",
+                status_code_text=f"[{invoke_error.__class__.__name__}] {_safe_str(invoke_error)}",
                 failure_category=failure_category_of(invoke_error),
                 file_data=request_dict.get("file_data", None),
             )