Skip to content

Stop leaking internal exception messages to client in MeiliSearchView.getuid - #98

Open
t0kubetsu wants to merge 1 commit into
D4-project:mainfrom
t0kubetsu:fix/exception-message-leak
Open

Stop leaking internal exception messages to client in MeiliSearchView.getuid#98
t0kubetsu wants to merge 1 commit into
D4-project:mainfrom
t0kubetsu:fix/exception-message-leak

Conversation

@t0kubetsu

Copy link
Copy Markdown
Contributor

Summary

Fixes #91

The /meili/getuid endpoint returned str(e) directly to authenticated users, which could expose Meilisearch internal error details, server host/port, or query structure.

Change

# Before
except Exception as e:
    return jsonify({"error": str(e)}), 404

# After
except Exception:
    logger.exception("Error fetching Meilisearch document uid=%s", uid)
    return jsonify({"error": "Document not found"}), 404

Test plan

  • Request a non-existent document UID and verify the response body is {"error": "Document not found"}
  • Verify the server log contains the full exception details

….getuid

Closes D4-project#91

The raw exception string from MeilisearchApiError could expose internal
server details (host, port, query structure) to authenticated users.
Log the exception server-side and return a generic 404 message instead.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

MEDIUM: Internal exception message exposed to client in MeiliSearchView.getuid (views.py:617)

1 participant