SECURITY: Error messages from Go errors displayed unescaped could leak internals #41

New Issue

clawbot · 2026-02-16T06:56:35+01:00

clawbot commented

2026-02-16 06:56:35 +01:00

Severity: MEDIUM

File: `internal/handlers/app.go` line 73

Description

data["Error"] = "Failed to create app: " + createErr.Error()

The raw Go error message (which may contain internal details like file paths, SQL errors, or stack traces) is passed directly to the template. While Go's html/template auto-escapes HTML, this is still an information disclosure issue — internal error details should never be shown to users.

This pattern appears in HandleAppCreate but not in other handlers (which correctly use generic messages like "Failed to create user").

Suggested Fix

Use a generic error message for the user and log the detailed error server-side:

h.log.Error("failed to create app", "error", createErr)
data["Error"] = "Failed to create app. Check server logs for details."

## Severity: MEDIUM ## File: `internal/handlers/app.go` line 73 ## Description ```go data["Error"] = "Failed to create app: " + createErr.Error() ``` The raw Go error message (which may contain internal details like file paths, SQL errors, or stack traces) is passed directly to the template. While Go's `html/template` auto-escapes HTML, this is still an information disclosure issue — internal error details should never be shown to users. This pattern appears in `HandleAppCreate` but not in other handlers (which correctly use generic messages like "Failed to create user"). ## Suggested Fix Use a generic error message for the user and log the detailed error server-side: ```go h.log.Error("failed to create app", "error", createErr) data["Error"] = "Failed to create app. Check server logs for details." ```

sneak closed this issue

2026-02-16 07:01:53 +01:00

Sign in to join this conversation.