From 977daab6aa5af36babd5d762dfa11a7d0bb85e73 Mon Sep 17 00:00:00 2001 From: admin-mf Date: Fri, 6 Mar 2026 00:04:23 -0600 Subject: [PATCH] security(launcher): remove internal details from HTTP error responses Log detailed errors server-side and return generic messages to clients to prevent information disclosure of file paths and internal state. Co-Authored-By: Claude Opus 4.6 --- cmd/picoclaw-launcher/internal/server/server.go | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/cmd/picoclaw-launcher/internal/server/server.go b/cmd/picoclaw-launcher/internal/server/server.go index 4fc68f04c..2c656d79a 100644 --- a/cmd/picoclaw-launcher/internal/server/server.go +++ b/cmd/picoclaw-launcher/internal/server/server.go @@ -32,7 +32,8 @@ func RegisterConfigAPI(mux *http.ServeMux, absPath string) { mux.HandleFunc("GET /api/config", func(w http.ResponseWriter, r *http.Request) { cfg, err := config.LoadConfig(absPath) if err != nil { - http.Error(w, fmt.Sprintf("Failed to load config: %v", err), http.StatusInternalServerError) + log.Printf("Failed to load config: %v", err) + http.Error(w, "Failed to load config", http.StatusInternalServerError) return } w.Header().Set("Content-Type", "application/json") @@ -63,7 +64,8 @@ func RegisterConfigAPI(mux *http.ServeMux, absPath string) { } if err := config.SaveConfig(absPath, &cfg); err != nil { - http.Error(w, fmt.Sprintf("Failed to save config: %v", err), http.StatusInternalServerError) + log.Printf("Failed to save config: %v", err) + http.Error(w, "Failed to save config", http.StatusInternalServerError) return } @@ -77,7 +79,8 @@ func RegisterAuthAPI(mux *http.ServeMux, absPath string) { mux.HandleFunc("GET /api/auth/status", func(w http.ResponseWriter, r *http.Request) { store, err := auth.LoadStore() if err != nil { - http.Error(w, fmt.Sprintf("Failed to load auth store: %v", err), http.StatusInternalServerError) + log.Printf("Failed to load auth store: %v", err) + http.Error(w, "Failed to load auth store", http.StatusInternalServerError) return }