Error handler leaks raw Postgres error messages (schema/column/UUID syntax) to clients #101

New issue

Closed

opened 2026-05-26 18:18:08 -04:00 by zgaetano · 1 comment

zgaetano commented

2026-05-26 18:18:08 -04:00

Owner

Fixed in 04ce096. errorHandler now classifies Postgres SQLSTATE codes (22P02, 23502, 23503, 23505, 42703, 42P01, 42601) and returns a generic message + the SQLSTATE code with the right HTTP status, never the raw err.message. 5xx responses are stable shape: {"error":"Internal Server Error","status":500}. 4xx still carry operator-authored messages. Full error always logged server-side.

Fixed in 04ce096. `errorHandler` now classifies Postgres SQLSTATE codes (22P02, 23502, 23503, 23505, 42703, 42P01, 42601) and returns a generic message + the SQLSTATE code with the right HTTP status, never the raw `err.message`. 5xx responses are stable shape: `{"error":"Internal Server Error","status":500}`. 4xx still carry operator-authored messages. Full error always logged server-side.

~~zgaetano referenced this issue 2026-05-26 18:22:49 -04:00~~

Tracker: 2026-05-26 audit session — 27 bugs logged (#100-#127) #128

zgaetano commented

2026-05-26 19:31:13 -04:00

Author

Owner

Fix Plan — #101 Error handler leaks raw Postgres messages

Root cause: src/middleware/errors.js returns err.message verbatim. PG errors expose schema names, column names, SQL state codes, parser positions.

Fix — src/middleware/errors.js:

const PG_ERROR_MAP = {
  "22P02": { status: 400, message: "Invalid input format" },  // bad UUID
  "23505": { status: 409, message: "Resource already exists" }, // unique violation
  "23503": { status: 409, message: "Referenced resource not found" }, // FK violation
  "42703": { status: 400, message: "Invalid field" },  // undefined column
};

function errorHandler(err, req, res, next) {
  const pg = PG_ERROR_MAP[err.code];
  if (pg) return res.status(pg.status).json({ error: pg.message });

  // Unknown errors: log server-side, generic client response
  console.error("Unhandled error:", err);
  return res.status(500).json({ error: "Internal Server Error" });
}

Also fix direct err.message returns in sdk.js:138 and assets.js:586.

Files: src/middleware/errors.js, src/routes/sdk.js:138, src/routes/assets.js:586
Effort: ~1h
**Priority: P0 — security/info leak

## Fix Plan — #101 Error handler leaks raw Postgres messages **Root cause:** `src/middleware/errors.js` returns `err.message` verbatim. PG errors expose schema names, column names, SQL state codes, parser positions. **Fix — `src/middleware/errors.js`:** ```js const PG_ERROR_MAP = { "22P02": { status: 400, message: "Invalid input format" }, // bad UUID "23505": { status: 409, message: "Resource already exists" }, // unique violation "23503": { status: 409, message: "Referenced resource not found" }, // FK violation "42703": { status: 400, message: "Invalid field" }, // undefined column }; function errorHandler(err, req, res, next) { const pg = PG_ERROR_MAP[err.code]; if (pg) return res.status(pg.status).json({ error: pg.message }); // Unknown errors: log server-side, generic client response console.error("Unhandled error:", err); return res.status(500).json({ error: "Internal Server Error" }); } ``` Also fix direct `err.message` returns in `sdk.js:138` and `assets.js:586`. **Files:** `src/middleware/errors.js`, `src/routes/sdk.js:138`, `src/routes/assets.js:586` **Effort:** ~1h **Priority: P0 — security/info leak

zgaetano referenced this issue

2026-05-26 19:42:16 -04:00

Tracker: 2026-05-26 audit session — 27 bugs logged (#100-#127) #128

zgaetano referenced this issue from a commit

2026-05-26 22:06:25 -04:00

chore: 1.2 ship-prep sweep — close 38 issues

zgaetano closed this issue

2026-05-26 22:09:54 -04:00