Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit d7d7f22

Browse filesBrowse files
dunglasyceruto
dunglas
authored and
yceruto
committed
[ErrorRenderer] Security fix: hide sensitive error messages
1 parent 05f7f4e commit d7d7f22
Copy full SHA for d7d7f22

File tree

9 files changed

+14
-14
lines changed
Filter options

9 files changed

+14
-14
lines changed

‎src/Symfony/Bundle/SecurityBundle/Tests/Functional/JsonLoginTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/SecurityBundle/Tests/Functional/JsonLoginTest.php
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,6 @@ public function testDefaultJsonLoginBadRequest()
7070

7171
$this->assertSame(400, $response->getStatusCode());
7272
$this->assertSame('application/json', $response->headers->get('Content-Type'));
73-
$this->assertSame(['title' => 'Bad Request', 'status' => 400, 'detail' => 'Invalid JSON.'], json_decode($response->getContent(), true));
73+
$this->assertSame(['title' => 'Bad Request', 'status' => 400], json_decode($response->getContent(), true));
7474
}
7575
}

‎src/Symfony/Component/ErrorRenderer/ErrorRenderer/JsonErrorRenderer.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/ErrorRenderer/ErrorRenderer/JsonErrorRenderer.php
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,9 +43,9 @@ public function render(FlattenException $exception): string
4343
$content = [
4444
'title' => $exception->getTitle(),
4545
'status' => $exception->getStatusCode(),
46-
'detail' => $exception->getMessage(),
4746
];
4847
if ($debug) {
48+
$content['detail'] = $exception->getMessage();
4949
$content['exceptions'] = $exception->toArray();
5050
}
5151

‎src/Symfony/Component/ErrorRenderer/ErrorRenderer/TxtErrorRenderer.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/ErrorRenderer/ErrorRenderer/TxtErrorRenderer.php
+2-1Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,9 +41,10 @@ public function render(FlattenException $exception): string
4141
$debug = $this->debug && ($exception->getHeaders()['X-Debug'] ?? true);
4242
$content = sprintf("[title] %s\n", $exception->getTitle());
4343
$content .= sprintf("[status] %s\n", $exception->getStatusCode());
44-
$content .= sprintf("[detail] %s\n", $exception->getMessage());
4544

4645
if ($debug) {
46+
$content .= sprintf("[detail] %s\n", $exception->getMessage());
47+
4748
foreach ($exception->toArray() as $i => $e) {
4849
$content .= sprintf("[%d] %s: %s\n", $i + 1, $e['class'], $e['message']);
4950
foreach ($e['trace'] as $trace) {

‎src/Symfony/Component/ErrorRenderer/ErrorRenderer/XmlErrorRenderer.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/ErrorRenderer/ErrorRenderer/XmlErrorRenderer.php
+4-2Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,12 +42,14 @@ public function render(FlattenException $exception): string
4242
{
4343
$debug = $this->debug && ($exception->getHeaders()['X-Debug'] ?? true);
4444
$title = $this->escapeXml($exception->getTitle());
45-
$message = $this->escapeXml($exception->getMessage());
4645
$statusCode = $this->escapeXml($exception->getStatusCode());
4746
$charset = $this->escapeXml($this->charset);
4847

4948
$exceptions = '';
49+
$message = '';
5050
if ($debug) {
51+
$message = '<detail>'.$this->escapeXml($exception->getMessage()).'</detail>';
52+
5153
$exceptions .= '<exceptions>';
5254
foreach ($exception->toArray() as $e) {
5355
$exceptions .= sprintf('<exception class="%s" message="%s"><traces>', $e['class'], $this->escapeXml($e['message']));
@@ -71,7 +73,7 @@ public function render(FlattenException $exception): string
7173
<problem xmlns="urn:ietf:rfc:7807">
7274
<title>{$title}</title>
7375
<status>{$statusCode}</status>
74-
<detail>{$message}</detail>
76+
{$message}
7577
{$exceptions}
7678
</problem>
7779
EOF;

‎src/Symfony/Component/ErrorRenderer/Tests/Command/DebugCommandTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/ErrorRenderer/Tests/Command/DebugCommandTest.php
+1-2Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,8 +56,7 @@ public function testFormatArgument()
5656
$this->assertSame(<<<TXT
5757
{
5858
"title": "Internal Server Error",
59-
"status": 500,
60-
"detail": "This is a sample exception."
59+
"status": 500
6160
}
6261
6362
TXT

‎src/Symfony/Component/ErrorRenderer/Tests/ErrorRenderer/JsonErrorRendererTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/ErrorRenderer/Tests/ErrorRenderer/JsonErrorRendererTest.php
+1-2Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,8 +44,7 @@ public function getRenderData(): iterable
4444
$expectedNonDebug = <<<JSON
4545
{
4646
"title": "Internal Server Error",
47-
"status": 500,
48-
"detail": "Foo"
47+
"status": 500
4948
}
5049
JSON;
5150

‎src/Symfony/Component/ErrorRenderer/Tests/ErrorRenderer/TxtErrorRendererTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/ErrorRenderer/Tests/ErrorRenderer/TxtErrorRendererTest.php
-1Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,6 @@ public function getRenderData(): iterable
3939
$expectedNonDebug = <<<TXT
4040
[title] Internal Server Error
4141
[status] 500
42-
[detail] Foo
4342
TXT;
4443

4544
yield '->render() returns the TXT content WITH stack traces in debug mode' => [

‎src/Symfony/Component/ErrorRenderer/Tests/ErrorRenderer/XmlErrorRendererTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/ErrorRenderer/Tests/ErrorRenderer/XmlErrorRendererTest.php
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ public function getRenderData(): iterable
4343
<problem xmlns="urn:ietf:rfc:7807">
4444
<title>Internal Server Error</title>
4545
<status>500</status>
46-
<detail>Foo</detail>
46+
4747
4848
</problem>
4949
XML;

‎src/Symfony/Component/HttpKernel/Tests/Controller/ErrorControllerTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/HttpKernel/Tests/Controller/ErrorControllerTest.php
+3-3Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ public function getInvokeControllerDataProvider()
6161
$request,
6262
FlattenException::createFromThrowable(new \Exception('foo')),
6363
500,
64-
'{"title": "Internal Server Error","status": 500,"detail": "foo"}',
64+
'{"title": "Internal Server Error","status": 500}',
6565
];
6666

6767
$request = new Request();
@@ -70,7 +70,7 @@ public function getInvokeControllerDataProvider()
7070
$request,
7171
FlattenException::createFromThrowable(new HttpException(405, 'Invalid request.')),
7272
405,
73-
'{"title": "Method Not Allowed","status": 405,"detail": "Invalid request."}',
73+
'{"title": "Method Not Allowed","status": 405}',
7474
];
7575

7676
$request = new Request();
@@ -79,7 +79,7 @@ public function getInvokeControllerDataProvider()
7979
$request,
8080
FlattenException::createFromThrowable(new HttpException(405, 'Invalid request.')),
8181
405,
82-
'{"title": "Method Not Allowed","status": 405,"detail": "Invalid request."}',
82+
'{"title": "Method Not Allowed","status": 405}',
8383
];
8484

8585
$request = new Request();

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.