Repository navigation
[Go] [HIGH] Exposed Internal Error Messages #159
Description
Problem
Five Go backend handlers return raw database or binding errors to the client, which discloses internal details such as table names, constraint names, and driver messages.
| File | Line | Current response |
|---|---|---|
go/backend/handlers/auth_handler.go |
36 | gin.H{"error": err.Error()} (400) |
go/backend/handlers/character_handler.go |
55 | gin.H{"error": result.Error.Error()} (500) |
go/backend/handlers/episode_handler.go |
55 | gin.H{"error": result.Error.Error()} (500) |
go/backend/handlers/quote_handler.go |
46 | gin.H{"error": result.Error.Error()} (500) |
go/backend/handlers/show_handler.go |
40 | gin.H{"error": result.Error.Error()} (500) |
Acceptance criteria
- Each 500 response returns a generic message (for example
"internal server error") and logs the underlying error server-side with the handler name. - The 400 response in
auth_handler.goreturns a generic validation message and does not echo the binding error. - Response shape stays
{"error": "<message>"}so existing clients keep working. - Add Go tests under
go/backend/handlers/that call each changed handler with a failing dependency and assert the response body does not contain the internal error text. -
cd go/backend && go test ./...passes.
Scope
- In scope: the five lines above and a small shared helper if it removes duplication.
- Out of scope: the other
BUG:comments in these files (SQL injection, missing error checks, response wrapping). They have their own issues.
Reacted by Copilot
Activity