Skip to content

fix(grpc): sanitize internal error details and log on server - #943

Closed
mopxam-art wants to merge 1 commit into
Heliobond:mainfrom
mopxam-art:fix/grpc-error-leak
Closed

mopxam-art wants to merge 1 commit into
Heliobond:mainfrom
mopxam-art:fix/grpc-error-leak

Conversation

@mopxam-art

Copy link
Copy Markdown

Why

Internal error messages and stack traces (including database errors, connection strings, and runtime panics) were being forwarded verbatim to gRPC clients in status details. The REST API sanitizes error details to generic messages, while the gRPC handlers bypassed sanitization and exposed internal error strings.

What

  • Replaced direct error.message forwarding in src/grpc/server.ts with generic GRPC_INTERNAL_ERROR_MESSAGE ("Internal server error").
  • Added comprehensive server-side logging (logger.error) with formatted error metadata, stack traces, and project context.
  • Hardened unary (getProjectScore), server streaming (streamProjectScores), and bidirectional chat (chatProjectScores) error handlers to prevent internal detail leakage across all RPC communication patterns.

Verified

  • Added comprehensive unit tests in src/__tests__/grpc-error-sanitization.test.ts (116 passing) verifying that sensitive strings (passwords, hostnames, SQL errors, stack traces) are never leaked to clients, real errors are logged on the server, and server stays resilient across failure bursts.
  • All 123 test suites (1,535 tests) pass (npm test).
  • Typecheck (npx tsc --noEmit) and linter pass with 0 errors.
  • Production build (npm run build) succeeded.

Closes #923

Payout coordinate:
USDC (EVM / Base / Arbitrum / ERC20): 0x387c064ccf729a4846b62e95dc6b70e4d4c41e73

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

gRPC error handler leaks internal error.message to clients in status details

2 participants