Bug #10136
WebRenderer::serveError leaks error details to end user
Start date:
04/08/2022
Due date:
% Done:
100%
Estimated time:
Description
serveError is used in several places where an unexpected exception is caught. The what() of this exception is then sent to the user.
We should not do this, at least not by default. Maybe we could allow the developer to turn it on for development, but normally the user should not get more information than "something went wrong", otherwise a malicious actor may be able to gain valuable information.
Updated by Roel Standaert 9 months ago
- Status changed from New to InProgress
- Assignee set to Roel Standaert
Updated by Roel Standaert 9 months ago
- Status changed from InProgress to Review
- Assignee deleted (
Roel Standaert)