fix: sanitize API error responses to prevent internal details leaking#146
fix: sanitize API error responses to prevent internal details leaking#146
Conversation
Replace all raw http.Error(w, err.Error(), ...) calls with a new writeJSONError helper that: - Logs the full internal error internally - Returns only a safe public message to the client as JSON Affected handlers: ListAuditLogs, CreateZone, ListZones, ListRecordsForZone, CreateRecord, DeleteZone, DeleteRecord. Fixes #86.
|
Warning Rate limit exceeded
To continue reviewing without waiting, purchase usage credits in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
The errcheck linter flagged that json.NewEncoder(w).Encode(resp) return value was not checked in writeJSONError. This could silently swallow encoding errors. Now logs the encoding failure internally. Fixes: #86
1 participant
Summary
Replace all raw
http.Error(w, err.Error(), ...)calls with a newwriteJSONErrorhelper that:h.logger.Error{"error": "..."}to the clienterr.Error()to clientsAffected handlers: ListAuditLogs, CreateZone, ListZones, ListRecordsForZone, CreateRecord, DeleteZone, DeleteRecord
Fixes #86.
Test plan
go build ./...— clean buildgo test ./... -timeout 60s— all tests pass