Skip to content

🛡️ Sentinel: Fix sensitive data leakage in error responses #20

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AGI-Corporation wants to merge 3 commits into
base: main
Choose a base branch
from
Open

🛡️ Sentinel: Fix sensitive data leakage in error responses #20

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ddf0875
🛡️ Sentinel: Fix sensitive data leakage in error responses
google-labs-jules[bot] Mar 19, 2026
6fea07f
🛡️ Sentinel: Fix sensitive data leakage in error responses
google-labs-jules[bot] Mar 19, 2026
b058d36
🛡️ Sentinel: Fix sensitive data leakage and restrict postMessage origin
google-labs-jules[bot] Mar 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .jules/sentinel.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
## 2025-03-19 - Sensitive Data Leakage in Error Parameters
Copy link
Copy Markdown

@coderabbitai coderabbitai bot Mar 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Fix the incident note date to match this PR timeline.

Line 1 says 2025-03-19, but this change set is from March 19, 2026. Keeping the exact date accurate matters for security audit trails.

📝 Suggested patch 
-## 2025-03-19 - Sensitive Data Leakage in Error Parameters
+## 2026-03-19 - Sensitive Data Leakage in Error Parameters
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
## 2025-03-19 - Sensitive Data Leakage in Error Parameters
## 2026-03-19 - Sensitive Data Leakage in Error Parameters
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.jules/sentinel.md at line 1, Update the incident note header that currently
reads "## 2025-03-19 - Sensitive Data Leakage in Error Parameters" to the
correct PR date (replace 2025-03-19 with 2026-03-19) so the sentinel entry's
timestamp matches the change set; ensure the header text "Sensitive Data Leakage
in Error Parameters" remains unchanged.

**Vulnerability:** JWT tokens and License Keys were being included in the `params` of `ActivepiecesError`.
**Learning:** The global backend error handler in `packages/server/api/src/app/helper/error-handler.ts` serializes all `error.error.params` directly to the client. If sensitive data like tokens or keys are included in these params, they are leaked in API responses.
**Prevention:** Always use `Record<string, never>` or ensure no sensitive fields are included in error parameter types defined in `packages/shared/src/lib/common/activepieces-error.ts`.
5 changes: 4 additions & 1 deletion packages/server/api/src/app/app.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,7 @@ import { pieceSyncService } from './pieces/piece-sync-service'
import { platformModule } from './platform/platform.module'
import { platformService } from './platform/platform.service'
import { projectHooks } from './project/project-hooks'
import { platformUtils } from './platform/platform.utils'
import { projectModule } from './project/project-module'
import { storeEntryModule } from './store-entry/store-entry.module'
import { tablesModule } from './tables/tables.module'
Expand Down Expand Up @@ -250,12 +251,14 @@ export const setupApp = async (app: FastifyInstance): Promise<FastifyInstance> =
return reply.send('The code is missing in url')
}
else {
const platformId = await platformUtils.getPlatformIdForRequest(request)
const targetOrigin = new URL(await domainHelper.getPublicUrl({ platformId })).origin
return reply
.type('text/html')
.send(
`<script>if(window.opener){window.opener.postMessage({ 'code': '${encodeURIComponent(
params.code,
)}' },'*')}</script> <html>Redirect succuesfully, this window should close now</html>`,
)}' }, '${targetOrigin}')}</script> <html>Redirect successfully, this window should close now</html>`,
)
}
},
Expand Down
8 changes: 2 additions & 6 deletions packages/server/api/src/app/ee/connection-keys/connection-key.service.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,9 +46,7 @@ export const connectionKeyService = (log: FastifyBaseLogger) => ({
if (connectionName == null) {
throw new ActivepiecesError({
code: ErrorCode.INVALID_OR_EXPIRED_JWT_TOKEN,
params: {
token,
},
params: {},
})
}
const connection = await appConnectionService(log).getOne({
Expand All @@ -74,9 +72,7 @@ export const connectionKeyService = (log: FastifyBaseLogger) => ({
if (connectionName == null) {
throw new ActivepiecesError({
code: ErrorCode.INVALID_OR_EXPIRED_JWT_TOKEN,
params: {
token: request.token,
},
params: {},
})
}

Expand Down
4 changes: 1 addition & 3 deletions packages/server/api/src/app/ee/license-keys/license-keys-controller.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,9 +40,7 @@ export const licenseKeysController: FastifyPluginAsyncTypebox = async (app) => {
if (isNil(key)) {
throw new ActivepiecesError({
code: ErrorCode.INVALID_LICENSE_KEY,
params: {
key: licenseKey,
},
params: {},
})
}
await platformService.update({
Expand Down
8 changes: 2 additions & 6 deletions packages/shared/src/lib/common/activepieces-error.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -278,9 +278,7 @@ ErrorCode.FLOW_IN_USE,

export type InvalidJwtTokenErrorParams = BaseErrorParams<
ErrorCode.INVALID_OR_EXPIRED_JWT_TOKEN,
{
token: string
}
Record<string, never>
>

export type TestTriggerFailedErrorParams = BaseErrorParams<
Expand Down Expand Up @@ -405,9 +403,7 @@ ErrorCode.EXISTING_ALERT_CHANNEL,

export type InvalidOtpParams = BaseErrorParams<ErrorCode.INVALID_OTP, Record<string, never>>

export type InvalidLicenseKeyParams = BaseErrorParams<ErrorCode.INVALID_LICENSE_KEY, {
key: string
}>
export type InvalidLicenseKeyParams = BaseErrorParams<ErrorCode.INVALID_LICENSE_KEY, Record<string, never>>

export type EmailAlreadyHasActivationKey = BaseErrorParams<ErrorCode.EMAIL_ALREADY_HAS_ACTIVATION_KEY, {
email: string
Expand Down
Loading