Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 95d47dd

Browse filesBrowse files
dunglasdunglas
committed
[ErrorRenderer] Security fix: hide sensitive error messages
1 parent 05f7f4e commit 95d47dd
Copy full SHA for 95d47dd

File tree

7 files changed

+10
-10
lines changed
Filter options

7 files changed

+10
-10
lines changed

‎src/Symfony/Component/ErrorRenderer/ErrorRenderer/JsonErrorRenderer.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/ErrorRenderer/ErrorRenderer/JsonErrorRenderer.php
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,9 +43,9 @@ public function render(FlattenException $exception): string
4343
$content = [
4444
'title' => $exception->getTitle(),
4545
'status' => $exception->getStatusCode(),
46-
'detail' => $exception->getMessage(),
4746
];
4847
if ($debug) {
48+
$content['detail'] = $exception->getMessage();
4949
$content['exceptions'] = $exception->toArray();
5050
}
5151

‎src/Symfony/Component/ErrorRenderer/ErrorRenderer/TxtErrorRenderer.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/ErrorRenderer/ErrorRenderer/TxtErrorRenderer.php
+2-1Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,9 +41,10 @@ public function render(FlattenException $exception): string
4141
$debug = $this->debug && ($exception->getHeaders()['X-Debug'] ?? true);
4242
$content = sprintf("[title] %s\n", $exception->getTitle());
4343
$content .= sprintf("[status] %s\n", $exception->getStatusCode());
44-
$content .= sprintf("[detail] %s\n", $exception->getMessage());
4544

4645
if ($debug) {
46+
$content .= sprintf("[detail] %s\n", $exception->getMessage());
47+
4748
foreach ($exception->toArray() as $i => $e) {
4849
$content .= sprintf("[%d] %s: %s\n", $i + 1, $e['class'], $e['message']);
4950
foreach ($e['trace'] as $trace) {

‎src/Symfony/Component/ErrorRenderer/ErrorRenderer/XmlErrorRenderer.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/ErrorRenderer/ErrorRenderer/XmlErrorRenderer.php
+4-2Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,12 +42,14 @@ public function render(FlattenException $exception): string
4242
{
4343
$debug = $this->debug && ($exception->getHeaders()['X-Debug'] ?? true);
4444
$title = $this->escapeXml($exception->getTitle());
45-
$message = $this->escapeXml($exception->getMessage());
4645
$statusCode = $this->escapeXml($exception->getStatusCode());
4746
$charset = $this->escapeXml($this->charset);
4847

4948
$exceptions = '';
49+
$message = '';
5050
if ($debug) {
51+
$message = '<detail>'.$this->escapeXml($exception->getMessage()).'</detail>';
52+
5153
$exceptions .= '<exceptions>';
5254
foreach ($exception->toArray() as $e) {
5355
$exceptions .= sprintf('<exception class="%s" message="%s"><traces>', $e['class'], $this->escapeXml($e['message']));
@@ -71,7 +73,7 @@ public function render(FlattenException $exception): string
7173
<problem xmlns="urn:ietf:rfc:7807">
7274
<title>{$title}</title>
7375
<status>{$statusCode}</status>
74-
<detail>{$message}</detail>
76+
{$message}
7577
{$exceptions}
7678
</problem>
7779
EOF;

‎src/Symfony/Component/ErrorRenderer/Tests/Command/DebugCommandTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/ErrorRenderer/Tests/Command/DebugCommandTest.php
+1-2Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,8 +56,7 @@ public function testFormatArgument()
5656
$this->assertSame(<<<TXT
5757
{
5858
"title": "Internal Server Error",
59-
"status": 500,
60-
"detail": "This is a sample exception."
59+
"status": 500
6160
}
6261
6362
TXT

‎src/Symfony/Component/ErrorRenderer/Tests/ErrorRenderer/JsonErrorRendererTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/ErrorRenderer/Tests/ErrorRenderer/JsonErrorRendererTest.php
+1-2Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,8 +44,7 @@ public function getRenderData(): iterable
4444
$expectedNonDebug = <<<JSON
4545
{
4646
"title": "Internal Server Error",
47-
"status": 500,
48-
"detail": "Foo"
47+
"status": 500
4948
}
5049
JSON;
5150

‎src/Symfony/Component/ErrorRenderer/Tests/ErrorRenderer/TxtErrorRendererTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/ErrorRenderer/Tests/ErrorRenderer/TxtErrorRendererTest.php
-1Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,6 @@ public function getRenderData(): iterable
3939
$expectedNonDebug = <<<TXT
4040
[title] Internal Server Error
4141
[status] 500
42-
[detail] Foo
4342
TXT;
4443

4544
yield '->render() returns the TXT content WITH stack traces in debug mode' => [

‎src/Symfony/Component/ErrorRenderer/Tests/ErrorRenderer/XmlErrorRendererTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/ErrorRenderer/Tests/ErrorRenderer/XmlErrorRendererTest.php
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ public function getRenderData(): iterable
4343
<problem xmlns="urn:ietf:rfc:7807">
4444
<title>Internal Server Error</title>
4545
<status>500</status>
46-
<detail>Foo</detail>
46+
4747
4848
</problem>
4949
XML;

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.