opencode/picoclaw
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

security(launcher): remove internal details from HTTP error responses

Browse source 
Log detailed errors server-side and return generic messages to
clients to prevent information disclosure of file paths and
internal state.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
admin-mf 2026-03-06 00:04:23 -06:00
parent c0352a07d2
commit 977daab6aa
1 changed files with 6 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
cmd/picoclaw-launcher/internal/server/server.go
View file

@ -32,7 +32,8 @@ func RegisterConfigAPI(mux *http.ServeMux, absPath string) {
mux.HandleFunc("GET /api/config", func(w http.ResponseWriter, r *http.Request) {
cfg, err := config.LoadConfig(absPath)
if err != nil {
http.Error(w, fmt.Sprintf("Failed to load config: %v", err), http.StatusInternalServerError)
log.Printf("Failed to load config: %v", err)
http.Error(w, "Failed to load config", http.StatusInternalServerError)
return
}
w.Header().Set("Content-Type", "application/json")
@ -63,7 +64,8 @@ func RegisterConfigAPI(mux *http.ServeMux, absPath string) {
}
if err := config.SaveConfig(absPath, &cfg); err != nil {
http.Error(w, fmt.Sprintf("Failed to save config: %v", err), http.StatusInternalServerError)
log.Printf("Failed to save config: %v", err)
http.Error(w, "Failed to save config", http.StatusInternalServerError)
return
}
@ -77,7 +79,8 @@ func RegisterAuthAPI(mux *http.ServeMux, absPath string) {
mux.HandleFunc("GET /api/auth/status", func(w http.ResponseWriter, r *http.Request) {
store, err := auth.LoadStore()
if err != nil {
http.Error(w, fmt.Sprintf("Failed to load auth store: %v", err), http.StatusInternalServerError)
log.Printf("Failed to load auth store: %v", err)
http.Error(w, "Failed to load auth store", http.StatusInternalServerError)
return
}