Quality: Error messages leak internal details to clients #113

New issue

Open

opened 2026-05-11 13:50:41 +00:00 by thabeta · 0 comments

thabeta commented

2026-05-11 13:50:41 +00:00

Owner

Severity: Medium

Location

Multiple handlers across api_openrouter/ and api_openrpc/

Finding

Error responses often include internal details:

Provider error messages forwarded directly to clients\n- Stack traces in error responses\n- Internal URLs and socket paths in error messages\n- Key pool status exposed in error responses

Impact

Information disclosure about internal architecture\n- Provider error messages may contain sensitive data\n- Attackers can use error details for reconnaissance

Recommendation

Sanitize error messages before sending to clients\n- Use structured error responses with error codes\n- Log internal details, return generic messages to clients\n- Add error sanitization middleware

## Severity: Medium ## Location Multiple handlers across `api_openrouter/` and `api_openrpc/` ## Finding Error responses often include internal details: - Provider error messages forwarded directly to clients\n- Stack traces in error responses\n- Internal URLs and socket paths in error messages\n- Key pool status exposed in error responses ## Impact - Information disclosure about internal architecture\n- Provider error messages may contain sensitive data\n- Attackers can use error details for reconnaissance ## Recommendation - Sanitize error messages before sending to clients\n- Use structured error responses with error codes\n- Log internal details, return generic messages to clients\n- Add error sanitization middleware