8000 [ErrorRenderer] Security fix: hide sensitive error messages · dunglas/symfony@d7d7f22 · GitHub
[go: up one dir, main page]
Skip to content

Commit d7d7f22

Browse files
dunglasyceruto
dunglas
authored and
yceruto
committed
[ErrorRenderer] Security fix: hide sensitive error messages
1 parent 05f7f4e commit d7d7f22

File tree

9 files changed

+14
-14
lines changed

9 files changed

+14
-14
lines changed

‎src/Symfony/Bundle/SecurityBundle/Tests/Functional/JsonLoginTest.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,6 @@ public function testDefaultJsonLoginBadRequest()
7070

7171
$this->assertSame(400, $response->getStatusCode());
7272
$this->assertSame('application/json', $response->headers->get('Content-Type'));
73-
$this->assertSame(['title' => 'Bad Request', 'status' => 400, 'detail' => 'Invalid JSON.'], json_decode($response->getContent(), true));
73+
$this->assertSame(['title' => 'Bad Request', 'status' => 400], json_decode($response->getContent(), true));
7474
}
7575
}

‎src/Symfony/Component/ErrorRenderer/ErrorRenderer/JsonErrorRenderer.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,9 +43,9 @@ public function render(FlattenException $exception): string
4343
$content = [
4444
'title' => $exception->getTitle(),
4545
'status' => $exception->getStatusCode(),
46-
'detail' => $exception->getMessage(),
4746
];
4847
if ($debug) {
48+
$content['detail'] = $exception->getMessage();
4949
$content['exceptions'] = $exception->toArray();
5050
}
5151

‎src/Symfony/Component/ErrorRenderer/ErrorRenderer/TxtErrorRenderer.php

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,9 +41,10 @@ public function render(FlattenException $exception): string
4141
$debug = $this->debug && ($exception->getHeaders()['X-Debug'] ?? true);
4242
$content = sprintf("[title] %s\n", $exception->getTitle());
4343
$content .= sprintf("[status] %s\n", $exception->getStatusCode());
44-
$content .= sprintf("[detail] %s\n", $exception->getMessage());
4544

4645
if ($debug) {
46+
$content .= sprintf("[detail] %s\n", $exception->getMessage());
47+
4748
foreach ($exception->toArray() as $i => $e) {
4849
$content .= sprintf("[%d] %s: %s\n", $i + 1, $e['class'], $e['message']);
4950
foreach ($e['trace'] as $trace) {

‎src/Symfony/Component/ErrorRenderer/ErrorRenderer/XmlErrorRenderer.php

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,12 +42,14 @@ public function render(FlattenException $exception): string
4242
{
4343
$debug = $this->debug && ($exception->getHeaders()['X-Debug'] ?? true);
4444
$title = $this->escapeXml($exception->getTitle());
45-
$message = $this->escapeXml($exception->getMessage());
4645
$statusCode = $this->escapeXml($exception->getStatusCode());
4746
$charset = $this->escapeXml($this->charset);
4847

4948
$exceptions = '';
49+
$message = '';
5050
if ($debug) {
51+
$message = '<detail>'.$this->escapeXml($exception->getMessage()).'</detail>';
52+
5153
$exceptions .= '<exceptions>';
5254
foreach ($exception->toArray() as $e) {
5355
$exceptions .= sprintf('<exception class="%s" message="%s"><traces>', $e['class'], $this->escapeXml($e['message']));
@@ -71,7 +73,7 @@ public function render(FlattenException $exception): string
7173
<problem xmlns="urn:ietf:rfc:7807">
7274
<title>{$title}</title>
7375
<status>{$statusCode}</status>
74-
<detail>{$message}</detail>
76+
{$message}
7577
{$exceptions}
7678
</problem>
7779
EOF;

‎src/Symfony/Component/ErrorRenderer/Tests/Command/DebugCommandTest.php

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,8 +56,7 @@ public function testFormatArgument()
5656
$this->assertSame(<<<TXT
5757
{
5858
"title": "Internal Server Error",
59-
"status": 500,
60-
"detail": "This is a sample exception."
59+
"status": 500
6160
}
6261
6362
TXT

‎src/Symfony/Component/ErrorRenderer/Tests/ErrorRenderer/JsonErrorRendererTest.php

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,8 +44,7 @@ public function getRenderData(): iterable
4444
$expectedNonDebug = <<<JSON
4545
{
4646
"title": "Internal Server Error",
47-
"status": 500,
48-
"detail": "Foo"
47+
"status": 500
4948
}
5049
JSON;
5150

‎src/Symfony/Component/ErrorRenderer/Tests/ErrorRenderer/TxtErrorRendererTest.php

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,6 @@ public function getRenderData(): iterable
3939
$expectedNonDebug = <<<TXT
4040
[title] Internal Server Error
4141
[status] 500
42-
[detail] Foo
4342
TXT;
4443

4544
yield '->render() returns the TXT content WITH stack traces in debug mode' => [

‎src/Symfony/Component/ErrorRenderer/Tests/ErrorRenderer/XmlErrorRendererTest.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ public function getRenderData(): iterable
4343
<problem xmlns="urn:ietf:rfc:7807">
4444
<title>Internal Server Error</title>
4545
<status>500</status>
46-
<detail>Foo</detail>
46+
4747
4848
</problem>
4949
XML;

‎src/Symfony/Component/HttpKernel/Tests/Controller/ErrorControllerTest.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ public function getInvokeControllerDataProvider()
6161
$request,
6262
FlattenException::createFromThrowable(new \Exception('foo')),
6363
500,
64-
'{"title": "Internal Server Error","status": 500,"detail": "foo"}',
64+
'{"title": "Internal Server Error","status": 500}',
6565
];
6666

6767
$request = new Request();
@@ -70,7 +70,7 @@ public function getInvokeControllerDataProvider()
7070
$request,
7171
FlattenException::createFromThrowable(new HttpException(405, 'Invalid request.')),
7272
405,
73-
'{"title": "Method Not Allowed","status": 405,"detail": "Invalid request."}',
73+
'{"title": "Method Not Allowed","status": 405}',
7474
];
7575

7676
$request = new Request();
@@ -79,7 +79,7 @@ public function getInvokeControllerDataProvider()
7979
$request,
8080
FlattenException::createFromThrowable(new HttpException(405, 'Invalid request.')),
8181
405,
82-
'{"title": "Method Not Allowed","status": 405,"detail": "Invalid request."}',
82+
'{"title": "Method Not Allowed","status": 405}',
8383
];
8484

8585
$request = new Request();

0 commit comments

Comments
 (0)
0