Skip to content

Attaching source code with triple brace causes exception #791

@phemmer

Description

@phemmer

If you try to add source code with contains a triple brace to the prompt context, an exception is generated.

Example file:

{{{ xyzzy }}}

Message:

hello

log:

2025-10-02 09:36:29,102 [ 607976]   INFO - STDOUT - 09:36:29.102 [AWT-EventQueue-0] INFO  c.d.g.u.w.h.WebViewAIMessageUpdater - Executing JavaScript to add user message
2025-10-02 09:36:29,102 [ 607976]   INFO - STDOUT - 09:36:29.102 [AWT-EventQueue-0] DEBUG c.d.g.u.w.handler.WebViewDebugLogger - [WebViewJavaScriptExecutor] [09:36:29.102][DEBUG][#92] JavaScript execution #{}: {}
2025-10-02 09:36:29,105 [ 607979]   INFO - STDOUT - 09:36:29.105 [AWT-EventQueue-0] DEBUG c.d.g.u.w.handler.WebViewDebugLogger - [WebViewJavaScriptExecutor] TIMING[jsExecution#80]: 1ms
2025-10-02 09:36:29,105 [ 607979]   INFO - STDOUT - 09:36:29.105 [prompt-exec-7] ERROR c.d.g.s.p.r.n.NonStreamingPromptExecutionService - Value for the variable ' xyzzy \}\' is missing
2025-10-02 09:36:29,105 [ 607979]   INFO - STDOUT - 09:36:29.105 [AWT-EventQueue-0] DEBUG c.d.g.u.w.handler.WebViewDebugLogger - [WebViewJavaScriptExecutor] TIMING[jsExecution#81]: 0ms
2025-10-02 09:36:29,105 [ 607979]   INFO - STDOUT - 09:36:29.105 [prompt-exec-7] ERROR c.d.g.s.prompt.error.PromptException - ERROR:Provider unavailable: Value for the variable ' xyzzy \}\' is missing - true
2025-10-02 09:36:29,105 [ 607979]   INFO - STDOUT - 09:36:29.105 [prompt-exec-7] ERROR c.d.g.s.prompt.error.PromptException - ERROR:Error occurred while processing chat message - false
2025-10-02 09:36:29,105 [ 607979]   INFO - STDOUT - 09:36:29.105 [prompt-exec-7] ERROR c.d.g.s.p.error.PromptErrorHandler - Error occurred while processing chat message
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - java.util.concurrent.CompletionException: com.devoxx.genie.service.prompt.error.ModelException: Provider unavailable: Value for the variable ' xyzzy \}\' is missing
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at java.base/java.util.concurrent.CompletableFuture.encodeThrowable(CompletableFuture.java:315)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at java.base/java.util.concurrent.CompletableFuture.completeThrowable(CompletableFuture.java:320)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at java.base/java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java:1770)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at java.base/java.lang.Thread.run(Thread.java:1583)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - Caused by: com.devoxx.genie.service.prompt.error.ModelException: Provider unavailable: Value for the variable ' xyzzy \}\' is missing
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at com.devoxx.genie.service.prompt.response.nonstreaming.NonStreamingPromptExecutionService.processChatMessage(NonStreamingPromptExecutionService.java:206)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at com.devoxx.genie.service.prompt.response.nonstreaming.NonStreamingPromptExecutionService.lambda$executeQuery$0(NonStreamingPromptExecutionService.java:75)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at java.base/java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java:1768)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	... 3 common frames omitted
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - Caused by: java.lang.IllegalArgumentException: Value for the variable ' xyzzy \}\' is missing
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at dev.langchain4j.internal.Exceptions.illegalArgument(Exceptions.java:19)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at dev.langchain4j.model.input.DefaultPromptTemplateFactory$DefaultTemplate.ensureAllVariablesProvided(DefaultPromptTemplateFactory.java:57)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at dev.langchain4j.model.input.DefaultPromptTemplateFactory$DefaultTemplate.render(DefaultPromptTemplateFactory.java:44)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at dev.langchain4j.model.input.PromptTemplate.apply(PromptTemplate.java:102)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at dev.langchain4j.service.DefaultAiServices.prepareUserMessage(DefaultAiServices.java:381)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at dev.langchain4j.service.DefaultAiServices$1.invoke(DefaultAiServices.java:150)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at com.devoxx.genie.service.prompt.response.nonstreaming.$Proxy294.chat(Unknown Source)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at com.devoxx.genie.service.prompt.response.nonstreaming.NonStreamingPromptExecutionService.processChatMessage(NonStreamingPromptExecutionService.java:183)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	... 5 common frames omitted

I also have concerns that this may cause untrusted code to be executed. This exception seems to indicate that the plugin is attempting to evaluate the content of the triple brace as some sort of code. If a user dumps a large project into the plugin's context, and that project contains a triple brace somewhere, can this result in arbitrary code execution? It's one thing for LLMs to generate bad code, but if simply sending a message to an LLM causes code execution, that's a major issue.

I might also suggest enabling private reporting for issues like this.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions