olaf/Link-Log
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

Log details obfuscated to not leak info

Browse Source
This commit is contained in:
olaf
2026-08-26 20:51:29 +02:00
parent b4b40e5c2c
commit 04b8a5a8b9
10 changed files with 109 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Security-audit.md
+8 -4
View File
@@ -54,13 +54,17 @@ The application should remain behind the production reverse proxy, with real DNS
### SA-002: Raw infrastructure errors are returned to clients
**Severity:** High
**Evidence:** SMTP and Mastodon routes interpolate exception text into `503`/`502` responses. Setup and email-address routes also expose mail-delivery exception text.
**Severity:** High, remediated in current worktree
**Evidence before remediation:** SMTP and Mastodon routes interpolated exception text into `503`/`502` responses. Setup and email-address routes also exposed mail-delivery exception text.
**Impact:** Error responses can disclose SMTP hostnames, ports, TLS/library details, upstream response bodies, internal network information, or sensitive URL fragments.
**Recommendation:** Log technical details server-side with a request/correlation ID and return a stable public message with a short reference ID. Redact credentials, authorization headers, reset tokens, OTP data, and secret-bearing URLs. Add tests asserting that representative exception text is absent from HTTP responses.
**Current state:** The application assigns a request ID at middleware entry, returns it in `X-Request-ID`, logs technical exception summaries server-side after redacting authorization values, tokens, passwords, secrets, OTP/code values, and secret-bearing URL query values, and returns stable public messages with a reference ID. SMTP setup/admin/email errors and Mastodon registration/callback errors no longer expose raw exception text. Regression tests verify representative exception and secret text is absent from HTTP responses.
**Priority:** High.
**Residual impact:** Logging currently uses the application logger rather than a centralized protected sink. Request-ID trust, log retention, access control, and structured redaction should be reviewed in deployment.
**Recommendation:** Keep public errors stable and reference-based, export redacted logs to a protected centralized system, define retention and access controls, and never log authorization headers or secret-bearing request data.
**Priority:** Completed in code; centralized logging and operational controls remain.
### SA-003: First-run setup is unauthenticated and lacks application-level body limits