bug: Error handler exposes sensitive error information in response #9

New Issue

2026-06-17T15:06:16Z

abumahid commented

2026-06-17 15:06:16 +00:00

Description

The global error handler includes the raw err object in JSON responses to clients. This exposes internal error objects, stack traces (in development), and potentially sensitive information about the application structure to attackers.

Location

File: src/app/middlewares/global_error_handler.ts
Component: globalErrorHandler middleware
Lines: 8-49

How to Fix

Remove the err object from the response and only send safe error information:

const globalErrorHandler: ErrorRequestHandler = (err, req, res, next) => {
  let statusCode = 500;
  let message = "Something went wrong!";
  let errorSources: TErrorSources = [
    {
      path: "",
      message: "Something went wrong",
    },
  ];

  if (err instanceof ZodError) {
    const simplifiedError = handleZodError(err);
    statusCode = simplifiedError?.statusCode;
    message = simplifiedError?.message;
    errorSources = simplifiedError?.errorSources;
  } else if (err instanceof AppError) {
    statusCode = err?.statusCode;
    message = err.message;
    errorSources = [
      {
        path: "",
        message: err?.message,
      },
    ];
  } else if (err instanceof Error) {
    message = err.message;
    errorSources = [
      {
        path: "",
        message: err?.message,
      },
    ];
  }

  res.status(statusCode).json({
    success: false,
    message,
    errorSources,
    // Remove 'err' and only include stack in development
    ...(configs.env === "development" && { stack: err?.stack }),
  });
};

Acceptance Criteria

Error response does not include raw error object
Stack trace is only included in development environment
Production responses only contain message and errorSources
Build passes
Error handling still works correctly
Type check passes

### Description The global error handler includes the raw `err` object in JSON responses to clients. This exposes internal error objects, stack traces (in development), and potentially sensitive information about the application structure to attackers. ### Location - **File:** `src/app/middlewares/global_error_handler.ts` - **Component:** `globalErrorHandler` middleware - **Lines:** 8-49 ### How to Fix Remove the `err` object from the response and only send safe error information: ```typescript const globalErrorHandler: ErrorRequestHandler = (err, req, res, next) => { let statusCode = 500; let message = "Something went wrong!"; let errorSources: TErrorSources = [ { path: "", message: "Something went wrong", }, ]; if (err instanceof ZodError) { const simplifiedError = handleZodError(err); statusCode = simplifiedError?.statusCode; message = simplifiedError?.message; errorSources = simplifiedError?.errorSources; } else if (err instanceof AppError) { statusCode = err?.statusCode; message = err.message; errorSources = [ { path: "", message: err?.message, }, ]; } else if (err instanceof Error) { message = err.message; errorSources = [ { path: "", message: err?.message, }, ]; } res.status(statusCode).json({ success: false, message, errorSources, // Remove 'err' and only include stack in development ...(configs.env === "development" && { stack: err?.stack }), }); }; ``` ### Acceptance Criteria - [ ] Error response does not include raw error object - [ ] Stack trace is only included in development environment - [ ] Production responses only contain message and errorSources - [ ] Build passes - [ ] Error handling still works correctly - [ ] Type check passes ---

abumahid added the Medium bug labels 2026-06-17 15:06:16 +00:00

abumahid added this to the quicklanch-server project 2026-06-17 15:06:16 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: summer2026/quicklanch-server#9