Skip to content

🛡️ Sentinel: Fix sensitive data leakage in error responses #40

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AGI-Corporation wants to merge 1 commit into
base: main
Choose a base branch
from
Open

🛡️ Sentinel: Fix sensitive data leakage in error responses #40

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .jules/sentinel.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
## 2025-05-15 - Exposure of Sensitive Data in Error Parameters
**Vulnerability:** Sensitive data (JWT tokens and License Keys) were included in the `params` field of `ActivepiecesError` objects, which are directly serialized and sent to the client by the global error handler in `packages/server/api/src/app/helper/error-handler.ts`.
**Learning:** The global error handler's behavior of exposing the entire `params` object means that any data placed there is effectively public if the error is triggered. This creates a leak if `params` is used to provide context for debugging that includes secrets.
**Prevention:** Strictly define error parameter types in `packages/shared/src/lib/common/activepieces-error.ts` to only include non-sensitive fields. Use `Record<string, never>` or empty objects for errors related to sensitive credentials.
8 changes: 2 additions & 6 deletions packages/server/api/src/app/ee/connection-keys/connection-key.service.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,9 +46,7 @@ export const connectionKeyService = (log: FastifyBaseLogger) => ({
if (connectionName == null) {
throw new ActivepiecesError({
code: ErrorCode.INVALID_OR_EXPIRED_JWT_TOKEN,
params: {
token,
},
params: {},
})
}
const connection = await appConnectionService(log).getOne({
Expand All @@ -74,9 +72,7 @@ export const connectionKeyService = (log: FastifyBaseLogger) => ({
if (connectionName == null) {
throw new ActivepiecesError({
code: ErrorCode.INVALID_OR_EXPIRED_JWT_TOKEN,
params: {
token: request.token,
},
params: {},
})
}

Expand Down
4 changes: 1 addition & 3 deletions packages/server/api/src/app/ee/license-keys/license-keys-controller.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,9 +40,7 @@ export const licenseKeysController: FastifyPluginAsyncTypebox = async (app) => {
if (isNil(key)) {
throw new ActivepiecesError({
code: ErrorCode.INVALID_LICENSE_KEY,
params: {
key: licenseKey,
},
params: {},
})
}
await platformService.update({
Expand Down
8 changes: 2 additions & 6 deletions packages/shared/src/lib/common/activepieces-error.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -278,9 +278,7 @@ ErrorCode.FLOW_IN_USE,

export type InvalidJwtTokenErrorParams = BaseErrorParams<
ErrorCode.INVALID_OR_EXPIRED_JWT_TOKEN,
{
token: string
}
Record<string, never>
>

export type TestTriggerFailedErrorParams = BaseErrorParams<
Expand Down Expand Up @@ -405,9 +403,7 @@ ErrorCode.EXISTING_ALERT_CHANNEL,

export type InvalidOtpParams = BaseErrorParams<ErrorCode.INVALID_OTP, Record<string, never>>

export type InvalidLicenseKeyParams = BaseErrorParams<ErrorCode.INVALID_LICENSE_KEY, {
key: string
}>
export type InvalidLicenseKeyParams = BaseErrorParams<ErrorCode.INVALID_LICENSE_KEY, Record<string, never>>

export type EmailAlreadyHasActivationKey = BaseErrorParams<ErrorCode.EMAIL_ALREADY_HAS_ACTIVATION_KEY, {
email: string
Expand Down
Loading