security: preview handlers leak raw err.Error() to clients #413

New issue

Closed

opened 2026-07-21 00:06:08 +02:00 by dries · 1 comment

dries commented

2026-07-21 00:06:08 +02:00

Owner

Finding #7 (Low) from a security review.

Problem

The GitHub/Forgejo preview handlers return raw err.Error() (with a 502) to the browser. Transport errors from http.Client.Do embed the full request URL and other internal detail. No token leak (auth is header-borne), but this contradicts the rest of the codebase which deliberately genericizes errors via serverError (internal/server/server.go:632-634).

Refs

internal/server/handlers_integrations.go:90,102,113,175,187,198

Suggested fix

Return a generic client message and log the real error server-side, matching the serverError pattern used elsewhere.

Acceptance

Preview failures return a generic message to the client; detail only in server logs.

Finding #7 (Low) from a security review. ## Problem The GitHub/Forgejo preview handlers return raw `err.Error()` (with a 502) to the browser. Transport errors from `http.Client.Do` embed the full request URL and other internal detail. No token leak (auth is header-borne), but this contradicts the rest of the codebase which deliberately genericizes errors via `serverError` (`internal/server/server.go:632-634`). ## Refs - `internal/server/handlers_integrations.go:90,102,113,175,187,198` ## Suggested fix Return a generic client message and log the real error server-side, matching the `serverError` pattern used elsewhere. ## Acceptance - Preview failures return a generic message to the client; detail only in server logs.