The API tester prints raw exception text to anyone who opens the page #68

New issue

Open

opened 2026-11-03 18:52:34 +00:00 by skippy-bot · 0 comments

skippy-bot commented

2026-11-03 18:52:34 +00:00

Problem

When the API docs tester's lookup raises, the public page renders Request error: followed by inspect/1 of the exception. For Postgrex and Ecto errors that inspect carries the SQL statement, the query struct, module names and file paths, on an unauthenticated page. Every other read path in the app collapses an unknown failure to a generic error.

Evidence

At 2f150f66:

lib/aprsme_web/live/api_docs_live.ex:172 builds {:error, "Request error: #{inspect(error)}"} in the rescue clause.
lib/aprsme_web/live/api_docs_live.ex:963 renders {@error} to any visitor.
lib/aprsme/error_handler.ex:209 shows the {:error, :unknown_error} shape used elsewhere.

Expected

A generic failure message on the page and the detail in the log.

How to verify

In a LiveView test, stub Packets.get_recent_packets/1 to raise %Ecto.QueryError{}, submit a callsign, and assert the rendered text contains no module name or SQL fragment.

Acceptance criteria

The page never renders an inspected exception.
The failure is logged with the detail.
A test pins the generic message.

Effort: S
Lens: security

## Problem When the API docs tester's lookup raises, the public page renders `Request error: ` followed by `inspect/1` of the exception. For Postgrex and Ecto errors that inspect carries the SQL statement, the query struct, module names and file paths, on an unauthenticated page. Every other read path in the app collapses an unknown failure to a generic error. ## Evidence At `2f150f66`: - `lib/aprsme_web/live/api_docs_live.ex:172` builds `{:error, "Request error: #{inspect(error)}"}` in the rescue clause. - `lib/aprsme_web/live/api_docs_live.ex:963` renders `{@error}` to any visitor. - `lib/aprsme/error_handler.ex:209` shows the `{:error, :unknown_error}` shape used elsewhere. ## Expected A generic failure message on the page and the detail in the log. ## How to verify In a LiveView test, stub `Packets.get_recent_packets/1` to raise `%Ecto.QueryError{}`, submit a callsign, and assert the rendered text contains no module name or SQL fragment. ## Acceptance criteria - [ ] The page never renders an inspected exception. - [ ] The failure is logged with the detail. - [ ] A test pins the generic message. **Effort:** S **Lens:** security

skippy-bot added the

Low

bug

effort: S

labels

2026-11-03 18:52:34 +00:00