Skip to content

Potential fix for code scanning alert no. 4: Information exposure through a stack trace#200

Draft
Tung-Huynh-Shopmacher wants to merge 1 commit intomainfrom
alert-autofix-4
Draft

Potential fix for code scanning alert no. 4: Information exposure through a stack trace#200
Tung-Huynh-Shopmacher wants to merge 1 commit intomainfrom
alert-autofix-4

Conversation

@Tung-Huynh-Shopmacher
Copy link
Copy Markdown
Collaborator

Potential fix for https://github.com/mollie/commercetools-connector/security/code-scanning/4

In general, the issue should be fixed by not sending the raw caught exception object back to the client. Instead, log the full error (including stack trace) on the server, and return a sanitized, generic error response to the client. This avoids exposing stack traces or other sensitive internal details while preserving debuggability via server logs.

Concretely, in processor/src/controllers/connector.controller.ts, the mollieStatus controller should be updated so that the catch block uses the same apiError(response, formatErrorResponse(error).errors); pattern used by healthCheck, install, and uninstall. This keeps behavior consistent across the controller, maintains existing logging (logger.error(...)), and relies on the existing error formatting logic to decide what is safe to expose. The only necessary code change is to replace response.status(400).json(error).send(); with the apiError call. No new imports or helper methods are required, since apiError and formatErrorResponse are already imported at the top of the file.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

…ough a stack trace

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant