Stop leaking internal error details to API clients #18

New Issue

2026-04-20T09:36:33Z

sharang commented

2026-04-20 09:36:33 +00:00

Problem

Internal error details (stack traces, SQL errors, file paths) are returned directly to clients:

Go handlers: gin.H{"error": err.Error()} — exposes Go runtime errors to external callers
Python routes: HTTPException(detail=str(e)) — exposes SQLAlchemy, psycopg2, and internal service errors

This aids attackers in fingerprinting the stack and crafting targeted exploits.

Required Actions

Python: create a global exception handler in main.py:

@app.exception_handler(Exception)
async def unhandled_exception(request, exc):
    logger.exception("Unhandled error", exc_info=exc)
    return JSONResponse({"detail": "Internal server error"}, status_code=500)

Go: create a httperr.Write variant that logs the full error internally and returns a sanitized message externally — the httperr package in ai-compliance-sdk/internal/platform/httperr/ should be updated
Only return detail=str(e) for domain validation errors (422) where the message is safe and user-facing

Acceptance Criteria

curl -X POST /api/v1/controls -d 'invalid' returns {"detail": "Internal server error"}, not a stack trace
Full error logged internally with request_id for correlation

## Problem Internal error details (stack traces, SQL errors, file paths) are returned directly to clients: - Go handlers: `gin.H{"error": err.Error()}` — exposes Go runtime errors to external callers - Python routes: `HTTPException(detail=str(e))` — exposes SQLAlchemy, psycopg2, and internal service errors This aids attackers in fingerprinting the stack and crafting targeted exploits. ## Required Actions 1. Python: create a global exception handler in `main.py`: ```python @app.exception_handler(Exception) async def unhandled_exception(request, exc): logger.exception("Unhandled error", exc_info=exc) return JSONResponse({"detail": "Internal server error"}, status_code=500) ``` 2. Go: create a `httperr.Write` variant that logs the full error internally and returns a sanitized message externally — the `httperr` package in `ai-compliance-sdk/internal/platform/httperr/` should be updated 3. Only return `detail=str(e)` for domain validation errors (422) where the message is safe and user-facing ## Acceptance Criteria - `curl -X POST /api/v1/controls -d 'invalid'` returns `{"detail": "Internal server error"}`, not a stack trace - Full error logged internally with `request_id` for correlation

sharang added this to the M3: Observability & Audit Logging milestone 2026-04-20 09:36:33 +00:00

sharang added the security severity: medium observability labels 2026-04-20 09:36:34 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Benjamin_Boenisch/breakpilot-compliance#18