A10: mask raw internal error text on CodeInternal responses #17

New issue

Closed

opened 2026-08-13 09:35:04 +00:00 by nalum · 0 comments

nalum commented

2026-08-13 09:35:04 +00:00

Owner

MapDBError falls through to connect.NewError(connect.CodeInternal, err) with the raw wrapped error (internal/services/svc/errors.go:57), and the pervasive fmt.Errorf("failed to X: %w", err) pattern rides the same path — including to unauthenticated callers via the auth interceptor (internal/auth/interceptor.go:117,145,161,190). Driver strings ("database is locked", pgx messages naming tables or constraints) cross the wire. No stack traces, paths, or secrets were observed.

The "failures name their reason" system rule pulls the other way, so scope this to CodeInternal only: domain and validation errors stay verbatim.

Fix: a final interceptor that keeps the code, replaces the Internal message with a generic reason plus a correlation id, and logs the detail server-side under that id.

Source: OWASP Top 10 (2025) audit of v1.1.0, 2026-08-13. File references point at the v1.1.0 tree.

`MapDBError` falls through to `connect.NewError(connect.CodeInternal, err)` with the raw wrapped error (`internal/services/svc/errors.go:57`), and the pervasive `fmt.Errorf("failed to X: %w", err)` pattern rides the same path — including to unauthenticated callers via the auth interceptor (`internal/auth/interceptor.go:117,145,161,190`). Driver strings ("database is locked", pgx messages naming tables or constraints) cross the wire. No stack traces, paths, or secrets were observed. The "failures name their reason" system rule pulls the other way, so scope this to `CodeInternal` only: domain and validation errors stay verbatim. **Fix**: a final interceptor that keeps the code, replaces the Internal message with a generic reason plus a correlation id, and logs the detail server-side under that id. --- Source: OWASP Top 10 (2025) audit of `v1.1.0`, 2026-08-13. File references point at the `v1.1.0` tree.

nalum added this to the v1.1.0 security audit milestone

2026-08-13 09:35:04 +00:00

nalum added the

security

severity/low

labels

2026-08-13 09:35:04 +00:00

nalum added reference refs/tags/v1.1.0

2026-08-13 09:37:47 +00:00

nalum referenced this issue from a commit

2026-08-13 10:25:08 +00:00

fix(svc): mask internal error text on the wire