Fix FileNotFoundError handling in rename_file methods

[aws-jasakshi]

Fix FileNotFoundError handling in rename_file methods

Summary

This PR fixes a security issue where the JupyterLab API returns HTTP 500 Internal Server Errors when attempting to rename non-existent files or directories. The fix ensures that proper HTTP 404 errors are returned instead, preventing information disclosure through verbose error messages.

Problem

• Issue: When a PATCH request is made to /jupyterlab/default/api/contents/ with a non-existent file path, the API returns HTTP 500 with verbose error messages including stack traces
• Security Impact: Exposes internal implementation details and file system information
• Expected Behavior: Should return HTTP 404 with appropriate error message

Solution

• Added FileNotFoundError exception handling to both synchronous and asynchronous rename_file methods in FileContentsManager
• Returns HTTP 404 error with message "File or directory does not exist: {path}" instead of generic HTTP 500
• Maintains existing error handling for other exceptions

Changes Made

1. Modified jupyter_server/services/contents/filemanager.py:

   • Added FileNotFoundError exception handling in rename_file method (line ~605)
   • Added FileNotFoundError exception handling in async rename_file method (line ~1073)
   • Both methods now return HTTP 404 with descriptive error message

2. Added test coverage:

   • New test test_rename_nonexistent in tests/services/contents/test_manager.py
   • Tests both file and directory rename scenarios
   • Validates proper HTTP 404 response and error message format

Testing

• ✅ Manual testing confirms HTTP 404 is returned for non-existent files
• ✅ Existing rename functionality for valid files remains unchanged
• ✅ New unit tests pass
• ✅ All existing tests continue to pass

Security Considerations

• Fixes information disclosure vulnerability
• Error messages are now generic and don't expose internal file paths beyond the user-provided path
• Maintains proper error handling hierarchy (HTTPError → FileNotFoundError → Exception)

Related Issues

• Addresses security finding from penetration testing
• Improves API error handling consistency
• Follows HTTP status code best practices

Checklist

• Code follows project style guidelines
• Self-review of code completed
• Tests added for new functionality
• All tests pass
• Documentation updated (if applicable)
• Security implications considered

Breaking Changes

None. This change only affects error responses for invalid operations and maintains backward compatibility for all valid operations.

Additional Notes

This fix addresses a security vulnerability where verbose error messages could expose internal system information. The change is minimal and focused, affecting only the error handling path for non-existent files during rename operations.

[dlqqq]

@aws-jasakshi Thank you for contributing this! Code changes look good to me, but I don't have permissions on this repo to merge.

@Zsailer Can you give this PR a review and merge if it looks good to you as well?