Error messages leak internal implementation details #172

New Issue

2026-04-10T16:04:14+02:00

shahondin1624 commented

2026-04-10 16:04:14 +02:00

Severity: LOW

Location

Various controllers and services

Description

Some error responses include exception messages that could reveal internal implementation details (e.g., ImportController returns 'Bundle-Import fehlgeschlagen: ' . $e->getMessage()). While the handleAction trait method uses generic "Internal server error" messages, some controllers still have manual catch blocks that expose details.

Recommendation

Ensure all 500 responses use generic messages; log details server-side only.

## Severity: LOW ## Location Various controllers and services ## Description Some error responses include exception messages that could reveal internal implementation details (e.g., `ImportController` returns `'Bundle-Import fehlgeschlagen: ' . $e->getMessage()`). While the `handleAction` trait method uses generic "Internal server error" messages, some controllers still have manual catch blocks that expose details. ## Recommendation Ensure all 500 responses use generic messages; log details server-side only.

shahondin1624 added the backend security priority:low labels 2026-04-10 16:04:14 +02:00

shahondin1624 referenced this issue from a commit

2026-04-10 16:23:49 +02:00

fix: use generic error messages in ImportController 500 responses (Closes #172)

shahondin1624 referenced a pull request that will close this issue

2026-04-10 16:23:55 +02:00

fix: use generic error messages in ImportController 500 responses (Closes #172) #183

shahondin1624 closed this issue

2026-04-10 16:24:01 +02:00

shahondin1624 referenced this issue from a commit

2026-04-10 16:24:02 +02:00

fix: use generic error messages in ImportController 500 responses (Closes #172) (#183)