github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-08 04:41:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): sanitize error responses to prevent information leakage (#5)

Browse Source 
* fix(security): sanitize error responses to prevent information leakage

Replace raw error messages in HTTP responses with generic messages.
Internal error details (stack traces, module paths, error messages)
were being returned to clients in 4 gateway endpoints.

* fix: sanitize 2 additional error response leaks in openresponses-http

Address CodeRabbit feedback: non-stream and streaming error paths in
openresponses-http.ts were still returning String(err) to clients.

* fix: add server-side error logging to sanitized catch blocks

Restore err parameter and add logWarn() calls so errors are still
captured server-side for diagnostics while keeping client responses
sanitized. Addresses CodeRabbit feedback about silently discarded errors.
This commit is contained in:
David Rudduck
2026-02-09 16:09:29 +10:00
committed by Peter Steinberger
parent de7d94d9e2
commit f788de30c8
3 changed files with 16 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/gateway/tools-invoke-http.ts
View File

@@ -348,9 +348,10 @@ export async function handleToolsInvokeHttpRequest(
const result = await (tool as any).execute?.(`http-${Date.now()}`, toolArgs);
sendJson(res, 200, { ok: true, result });
} catch (err) {
logWarn(`tools-invoke: tool execution failed: ${String(err)}`);
sendJson(res, 400, {
ok: false,
error: { type: "tool_error", message: err instanceof Error ? err.message : String(err) },
error: { type: "tool_error", message: "tool execution failed" },
});
}