Repository navigation
fix(grpc): sanitize internal error details and log on server - #943
Closed
mopxam-art wants to merge 1 commit into
Closed
mopxam-art wants to merge 1 commit into
mopxam-art wants to merge 1 commit into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Internal error messages and stack traces (including database errors, connection strings, and runtime panics) were being forwarded verbatim to gRPC clients in status
details. The REST API sanitizes error details to generic messages, while the gRPC handlers bypassed sanitization and exposed internal error strings.What
error.messageforwarding insrc/grpc/server.tswith genericGRPC_INTERNAL_ERROR_MESSAGE("Internal server error").logger.error) with formatted error metadata, stack traces, and project context.getProjectScore), server streaming (streamProjectScores), and bidirectional chat (chatProjectScores) error handlers to prevent internal detail leakage across all RPC communication patterns.Verified
src/__tests__/grpc-error-sanitization.test.ts(116 passing) verifying that sensitive strings (passwords, hostnames, SQL errors, stack traces) are never leaked to clients, real errors are logged on the server, and server stays resilient across failure bursts.npm test).npx tsc --noEmit) and linter pass with 0 errors.npm run build) succeeded.Closes #923
Payout coordinate:
USDC (EVM / Base / Arbitrum / ERC20): 0x387c064ccf729a4846b62e95dc6b70e4d4c41e73