- 
                Notifications
    
You must be signed in to change notification settings  - Fork 76
 
Open
Description
If you try to add source code with contains a triple brace to the prompt context, an exception is generated.
Example file:
{{{ xyzzy }}}
Message:
hello
log:
2025-10-02 09:36:29,102 [ 607976]   INFO - STDOUT - 09:36:29.102 [AWT-EventQueue-0] INFO  c.d.g.u.w.h.WebViewAIMessageUpdater - Executing JavaScript to add user message
2025-10-02 09:36:29,102 [ 607976]   INFO - STDOUT - 09:36:29.102 [AWT-EventQueue-0] DEBUG c.d.g.u.w.handler.WebViewDebugLogger - [WebViewJavaScriptExecutor] [09:36:29.102][DEBUG][#92] JavaScript execution #{}: {}
2025-10-02 09:36:29,105 [ 607979]   INFO - STDOUT - 09:36:29.105 [AWT-EventQueue-0] DEBUG c.d.g.u.w.handler.WebViewDebugLogger - [WebViewJavaScriptExecutor] TIMING[jsExecution#80]: 1ms
2025-10-02 09:36:29,105 [ 607979]   INFO - STDOUT - 09:36:29.105 [prompt-exec-7] ERROR c.d.g.s.p.r.n.NonStreamingPromptExecutionService - Value for the variable ' xyzzy \}\' is missing
2025-10-02 09:36:29,105 [ 607979]   INFO - STDOUT - 09:36:29.105 [AWT-EventQueue-0] DEBUG c.d.g.u.w.handler.WebViewDebugLogger - [WebViewJavaScriptExecutor] TIMING[jsExecution#81]: 0ms
2025-10-02 09:36:29,105 [ 607979]   INFO - STDOUT - 09:36:29.105 [prompt-exec-7] ERROR c.d.g.s.prompt.error.PromptException - ERROR:Provider unavailable: Value for the variable ' xyzzy \}\' is missing - true
2025-10-02 09:36:29,105 [ 607979]   INFO - STDOUT - 09:36:29.105 [prompt-exec-7] ERROR c.d.g.s.prompt.error.PromptException - ERROR:Error occurred while processing chat message - false
2025-10-02 09:36:29,105 [ 607979]   INFO - STDOUT - 09:36:29.105 [prompt-exec-7] ERROR c.d.g.s.p.error.PromptErrorHandler - Error occurred while processing chat message
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - java.util.concurrent.CompletionException: com.devoxx.genie.service.prompt.error.ModelException: Provider unavailable: Value for the variable ' xyzzy \}\' is missing
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at java.base/java.util.concurrent.CompletableFuture.encodeThrowable(CompletableFuture.java:315)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at java.base/java.util.concurrent.CompletableFuture.completeThrowable(CompletableFuture.java:320)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at java.base/java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java:1770)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at java.base/java.lang.Thread.run(Thread.java:1583)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - Caused by: com.devoxx.genie.service.prompt.error.ModelException: Provider unavailable: Value for the variable ' xyzzy \}\' is missing
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at com.devoxx.genie.service.prompt.response.nonstreaming.NonStreamingPromptExecutionService.processChatMessage(NonStreamingPromptExecutionService.java:206)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at com.devoxx.genie.service.prompt.response.nonstreaming.NonStreamingPromptExecutionService.lambda$executeQuery$0(NonStreamingPromptExecutionService.java:75)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at java.base/java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java:1768)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	... 3 common frames omitted
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - Caused by: java.lang.IllegalArgumentException: Value for the variable ' xyzzy \}\' is missing
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at dev.langchain4j.internal.Exceptions.illegalArgument(Exceptions.java:19)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at dev.langchain4j.model.input.DefaultPromptTemplateFactory$DefaultTemplate.ensureAllVariablesProvided(DefaultPromptTemplateFactory.java:57)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at dev.langchain4j.model.input.DefaultPromptTemplateFactory$DefaultTemplate.render(DefaultPromptTemplateFactory.java:44)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at dev.langchain4j.model.input.PromptTemplate.apply(PromptTemplate.java:102)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at dev.langchain4j.service.DefaultAiServices.prepareUserMessage(DefaultAiServices.java:381)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at dev.langchain4j.service.DefaultAiServices$1.invoke(DefaultAiServices.java:150)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at com.devoxx.genie.service.prompt.response.nonstreaming.$Proxy294.chat(Unknown Source)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	at com.devoxx.genie.service.prompt.response.nonstreaming.NonStreamingPromptExecutionService.processChatMessage(NonStreamingPromptExecutionService.java:183)
2025-10-02 09:36:29,106 [ 607980]   INFO - STDOUT - 	... 5 common frames omitted
I also have concerns that this may cause untrusted code to be executed. This exception seems to indicate that the plugin is attempting to evaluate the content of the triple brace as some sort of code. If a user dumps a large project into the plugin's context, and that project contains a triple brace somewhere, can this result in arbitrary code execution? It's one thing for LLMs to generate bad code, but if simply sending a message to an LLM causes code execution, that's a major issue.
I might also suggest enabling private reporting for issues like this.
Metadata
Metadata
Assignees
Labels
No labels