Add EventNotificationHandler example#1701
Merged
xavdid-stripe merged 1 commit intobetafrom Dec 16, 2025
Merged
Conversation
xavdid-stripe
requested review from
jar-stripe
and removed request for
a team
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| handler.handle(webhook_body, sig_header) | ||
| return jsonify(success=True), 200 | ||
| except Exception as e: | ||
| return jsonify(error=str(e)), 500 |
Check warning
Code scanning / CodeQL
Information exposure through an exception Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 5 months ago
To fix the information exposure, we should avoid returning internal error messages or exception details (like str(e)) to API clients. Instead, log the actual exception—including the traceback if desired—using server-side logging (for example, using Python's standard logging module), and return a generic error message to the client.
The fix requires:
- Importing
loggingat the top of the file if not already present. - Optionally configuring the logger if desired, or just using the root logger.
- In the exception handler, log the full exception and traceback using
logging.exception()(or similar). - Return a generic message in the response, such as
"An internal error has occurred.", rather than user-facing exception details.
The code to change is in the exception handler in the webhook() function, specifically on lines 54–55. Logging should be done inside the except block, before returning the generic message.
Suggested changeset
1
examples/event_notification_handler_endpoint.py
| @@ -11,7 +11,7 @@ | ||
|
|
||
| import os | ||
| from flask import Flask, request, jsonify | ||
|
|
||
| import logging | ||
| from stripe import StripeClient, UnhandledNotificationDetails | ||
| from stripe.v2.core import EventNotification | ||
| from stripe.events import V1BillingMeterErrorReportTriggeredEventNotification | ||
| @@ -52,4 +52,5 @@ | ||
| handler.handle(webhook_body, sig_header) | ||
| return jsonify(success=True), 200 | ||
| except Exception as e: | ||
| return jsonify(error=str(e)), 500 | ||
| logging.exception("Exception occurred while handling webhook") | ||
| return jsonify(error="An internal error has occurred."), 500 |
Copilot is powered by AI and may make mistakes. Always verify output.
ramya-stripe
approved these changes
Dec 16, 2025
jar-stripe
approved these changes
Dec 16, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why?
The hosted docs were a little late merging, so I wanted to make sure they got linked in the changelog. Plus I added the fully-working example from the original PR to the actual code. I also took the opportunity to make sure the hosted docs matched these working examples.
What?
See Also