SECURITY: Error messages from Go errors displayed unescaped could leak internals #41

Nytt Ärende

clawbot · 2026-02-16T06:56:35+01:00

clawbot kommenterad

2026-02-16 06:56:35 +01:00

Severity: MEDIUM

File: `internal/handlers/app.go` line 73

Description

data["Error"] = "Failed to create app: " + createErr.Error()

The raw Go error message (which may contain internal details like file paths, SQL errors, or stack traces) is passed directly to the template. While Go's html/template auto-escapes HTML, this is still an information disclosure issue — internal error details should never be shown to users.

This pattern appears in HandleAppCreate but not in other handlers (which correctly use generic messages like "Failed to create user").

Suggested Fix

Use a generic error message for the user and log the detailed error server-side:

h.log.Error("failed to create app", "error", createErr)
data["Error"] = "Failed to create app. Check server logs for details."

## Severity: MEDIUM ## File: `internal/handlers/app.go` line 73 ## Description ```go data["Error"] = "Failed to create app: " + createErr.Error() ``` The raw Go error message (which may contain internal details like file paths, SQL errors, or stack traces) is passed directly to the template. While Go's `html/template` auto-escapes HTML, this is still an information disclosure issue — internal error details should never be shown to users. This pattern appears in `HandleAppCreate` but not in other handlers (which correctly use generic messages like "Failed to create user"). ## Suggested Fix Use a generic error message for the user and log the detailed error server-side: ```go h.log.Error("failed to create app", "error", createErr) data["Error"] = "Failed to create app. Check server logs for details." ```

sneak stängde ärendet

2026-02-16 07:01:53 +01:00

Logga in för att delta i denna konversation.

1 Deltagare

Notiser

Förfallodatum

Inget förfallodatum satt.

Beroenden

No dependencies set.

Reference: sneak/upaas#41

SECURITY: Error messages from Go errors displayed unescaped could leak internals #41

Severity: MEDIUM

File: internal/handlers/app.go line 73

Description

Suggested Fix

File: `internal/handlers/app.go` line 73