Skip to content

Handle unknown routes to avoid stack traces leaks #18972

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Nov 4, 2023
Merged

Handle unknown routes to avoid stack traces leaks #18972

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 9 additions & 1 deletion components/server/src/express-util.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,7 +73,15 @@ export function unhandledToError(req: express.Request, res: express.Response, ne
if (isAnsweredRequest(req, res)) {
return next();
}
return next(new Error("unhandled request: " + req.method + " " + req.originalUrl));
/* Handle unknown routes gracefully to improve user experience and security.
* - Use a 404 status to indicate a "Not Found" error.
* - Provide a clear and informative message to guide the user.
* - Avoid exposing stack traces to prevent potential security vulnerabilities.
* Note: Detailed error logging is delegated to the `bottomErrorHandler()` function.
*/
res.status(404).send(
"Resource Not Accessible: The content you're attempting to access may have been removed, renamed, or is temporarily unavailable. Kindly verify the URL and retry.",
);
}

/**
Expand Down