Disable flask and quart debug (#14042)

### What problem does this PR solve?

Visit
`http://127.0.0.1:9381/?__debugger__=yes&cmd=resource&f=debugger.js`
will expose the flask code:
```
docReady(() => {
  if (!EVALEX_TRUSTED) {
    initPinBox();
  }
  // if we are in console mode, show the console.
  if (CONSOLE_MODE && EVALEX) {
    createInteractiveConsole();
  }

  const frames = document.querySelectorAll("div.traceback div.frame");
  if (EVALEX) {
    addConsoleIconToFrames(frames);
  }
  addEventListenersToElements(document.querySelectorAll("div.detail"), "click", () =>
    document.querySelector("div.traceback").scrollIntoView(false)
  );
  addToggleFrameTraceback(frames);
  addToggleTraceTypesOnClick(document.querySelectorAll("h2.traceback"));
  addInfoPrompt(document.querySelectorAll("span.nojavascript"));
  wrapPlainTraceback();
});

function addToggleFrameTraceback(frames) {
  frames.forEach((frame) => {
    frame.addEventListener("click", () => {
      frame.getElementsByTagName("pre")[0].parentElement.classList.toggle("expanded");
    });
  })
}

```

### Type of change

- [x] Other (please describe): Fix security risk
This commit is contained in:
Zhichang Yu
2026-04-10 18:01:49 +08:00
committed by GitHub
parent cfc2928de2
commit a9ca4ea1a1
4 changed files with 12 additions and 10 deletions

View File

@@ -21,7 +21,6 @@ import os
import signal
import logging
import threading
import traceback
import faulthandler
from flask import Flask
@@ -75,10 +74,10 @@ if __name__ == '__main__':
application=app,
threaded=True,
use_reloader=False,
use_debugger=True,
use_debugger=False,
)
except Exception:
traceback.print_exc()
except Exception as e:
logging.exception(f"Unhandled exception: {e}")
stop_event.set()
time.sleep(1)
os.kill(os.getpid(), signal.SIGKILL)