Skip to content

Fix API Error Handling to Prevent Internal Error Leakage#8282

Open
atul-upadhyay-7 wants to merge 1 commit into
JhaSourav07:mainfrom
atul-upadhyay-7:fix/api-github-error-leak-8280
Open

Fix API Error Handling to Prevent Internal Error Leakage#8282
atul-upadhyay-7 wants to merge 1 commit into
JhaSourav07:mainfrom
atul-upadhyay-7:fix/api-github-error-leak-8280

Conversation

@atul-upadhyay-7

@atul-upadhyay-7 atul-upadhyay-7 commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

Description

Fixes #8280

The /api/github route handler was returning raw error.message strings directly to the client in the default 500 fallback via the getSafeErrorMessage helper. This inadvertently leaked internal Node.js stack traces, backend connection errors (like ECONNREFUSED), and raw upstream GitHub API responses.

This PR:

  • Replaces the raw response with a hardcoded, generic message ("An unexpected error occurred. Please try again.").
  • Preserves the full error stack trace server-side via the logger.error infrastructure.
  • Removes the now-unused getSafeErrorMessage helper.
  • Updates the 3 existing test cases (route.test.ts and route.error-resilience.test.ts) that previously asserted the presence of the raw error strings, so they now assert the generic fallback string instead.

Pillar

  • 🎨 Pillar 1 — New Theme Design
  • 📐 Pillar 2 — Geometric SVG Improvement
  • 🕐 Pillar 3 — Timezone Logic Optimization
  • 🛠️ Other (Bug fix, refactoring, docs)

Visual Preview

N/A - Backend API logic change only.

Checklist before requesting a review:

  • I have read the CONTRIBUTING.md file.
  • I have tested these changes locally (localhost:3000/api/streak?user=YOUR_USERNAME).
  • I have run npm run format and npm run lint locally and resolved all errors (CI will fail otherwise).
  • My commits follow the Conventional Commits format (e.g., feat(themes): ..., fix(calculate): ...).
  • I have updated README.md if I added a new theme or URL parameter.
  • I have started the repo.
  • I have made sure that i have only one commit to merge in this PR.
  • The SVG output matches the CommitPulse "premium quality" aesthetic standard (no raw elements, smooth animations, correct fonts).
  • (Recommended) I joined the CommitPulse Discord community for contributor discussions, mentorship, and faster PR support.

Copilot AI review requested due to automatic review settings July 23, 2026 03:54
@vercel

vercel Bot commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

@atul-upadhyay-7 is attempting to deploy a commit to the jhasourav07's projects Team on Vercel.

A member of the Team first needs to authorize it.

@retenta-bot

retenta-bot Bot commented Jul 23, 2026

Copy link
Copy Markdown

This pull request enhances the error handling of the /api/github route by ensuring that sensitive internal error messages are not exposed to clients. Instead, a generic error message is returned, while detailed error information is logged server-side. This aligns with our previous decisions to improve error resilience and exception handling, as seen in the related tests for the /api/streak route. Thank you for your contribution, and I look forward to your updates!

Copilot AI reviewed Jul 23, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@retenta-bot retenta-bot Bot changed the title fix(api): prevent raw internal error leakage on 500 response Fix API Error Handling to Prevent Internal Error Leakage Jul 23, 2026
@github-actions

github-actions Bot commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

📦 Next.js Bundle Size Report (Gzipped Sizes)

✨ No significant bundle size changes detected.

📊 Summary of Totals

Category PR Size Base Size Difference
Total JS 3984.83 KB 3984.83 KB 0 B
Total CSS 331.41 KB 331.41 KB 0 B

@Aamod007 Aamod007 added level:critical High-priority or mission-critical contributions affecting core systems, security, or infrastructure type:bug Something isn't working as expected mentor:Aamod007 labels Jul 23, 2026
Aamod007
Aamod007 requested changes Jul 23, 2026
View reviewed changes

@Aamod007 Aamod007 left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for updating the error handling in \�pp/api/github/route.ts\ to prevent internal error leakage. The changes in the route and test files are correct.

However, it looks like you've accidentally committed several rogue testing files and logs (\ est_next_request.ts, \ est_output.log, \ est_output2.log, and \ est_request.ts).

How to fix:
Please revert or remove these unrelated files from your branch so we only merge the API fix. You can do this by running \git rm test_output.log test_output2.log test_request.ts test_next_request.ts, committing the removal, and pushing it to this branch.

I am requesting changes until these files are removed.

Label Justification:

  • \level:critical: Assigned based on 7 files changed (though most are accidental).
  • \ ype:bug: Fixes internal error leakage.
  • \mentor:Aamod007: Assigned as required.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments
@Aamod007 Aamod007 Aamod007 requested changes

Assignees

No one assigned

Labels

level:critical High-priority or mission-critical contributions affecting core systems, security, or infrastructure mentor:Aamod007 type:bug Something isn't working as expected

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

GET /api/github leaks raw internal error messages to unauthenticated callers on 500 responses

3 participants

@atul-upadhyay-7 @Aamod007