4 Commits

Author SHA1 Message Date
bb078b4d6a Fix error handling to properly use formatError utility and improve environment detection
- Actually use the formatError function in the error handling code
- Update formatError function to accept env parameter for Cloudflare Workers
- Improve environment detection to use WORKER_ENV instead of process.env
- Update tests to match new function signature
- Add comprehensive test coverage for error formatting
- Fix linting issues and ensure proper TypeScript types
2025-06-10 00:46:21 +02:00
33577bb2d5 Potential fix for code scanning alert no. 6: Information exposure through a stack trace
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
2025-06-10 00:35:27 +02:00
adea8ae6b7 Refactor error payload logic 2025-06-10 00:27:54 +02:00
ef8601dd72 chore: secure error response 2025-06-10 00:17:24 +02:00
6 changed files with 132 additions and 41 deletions

View File

@@ -1,32 +0,0 @@
/**
* Fetches transcript content from a URL with optional authentication
* @param url The URL to fetch the transcript from
* @param username Optional username for Basic Auth
* @param password Optional password for Basic Auth
* @returns The transcript content or null if fetching fails
*/
export async function fetchTranscriptContent(
url: string,
username?: string,
password?: string
): Promise<string | null> {
try {
const authHeader =
username && password
? "Basic " + Buffer.from(`${username}:${password}`).toString("base64")
: undefined;
const response = await fetch(url, {
headers: authHeader ? { Authorization: authHeader } : {},
});
if (!response.ok) {
process.stderr.write(`Error fetching transcript from ${url}: ${response.statusText}\n`);
return null;
}
return await response.text();
} catch (error) {
process.stderr.write(`Failed to fetch transcript from ${url}: ${error}\n`);
return null;
}
}

View File

@@ -2,7 +2,6 @@
import cron from "node-cron";
import { prisma } from "./prisma";
import { fetchAndParseCsv } from "./csvFetcher";
import { fetchTranscriptContent } from "./fetchTranscript";
interface SessionCreateData {
id: string;
@@ -11,6 +10,41 @@ interface SessionCreateData {
[key: string]: unknown;
}
/**
* Fetches transcript content from a URL with optional authentication
* @param url The URL to fetch the transcript from
* @param username Optional username for Basic Auth
* @param password Optional password for Basic Auth
* @returns The transcript content or null if fetching fails
*/
async function fetchTranscriptContent(
url: string,
username?: string,
password?: string
): Promise<string | null> {
try {
const authHeader =
username && password
? "Basic " + Buffer.from(`${username}:${password}`).toString("base64")
: undefined;
const response = await fetch(url, {
headers: authHeader ? { Authorization: authHeader } : {},
});
if (!response.ok) {
process.stderr.write(
`Error fetching transcript: ${response.statusText}\n`
);
return null;
}
return await response.text();
} catch (error) {
process.stderr.write(`Failed to fetch transcript: ${error}\n`);
return null;
}
}
export function startScheduler() {
cron.schedule("*/15 * * * *", async () => {
const companies = await prisma.company.findMany();

View File

@@ -2,7 +2,6 @@
import { NextApiRequest, NextApiResponse } from "next";
import { fetchAndParseCsv } from "../../../lib/csvFetcher";
import { prisma } from "../../../lib/prisma";
import { fetchTranscriptContent } from "../../../lib/fetchTranscript";
interface SessionCreateData {
id: string;
@@ -12,6 +11,41 @@ interface SessionCreateData {
[key: string]: unknown;
}
/**
* Fetches transcript content from a URL with optional authentication
* @param url The URL to fetch the transcript from
* @param username Optional username for Basic Auth
* @param password Optional password for Basic Auth
* @returns The transcript content or null if fetching fails
*/
async function fetchTranscriptContent(
url: string,
username?: string,
password?: string
): Promise<string | null> {
try {
const authHeader =
username && password
? "Basic " + Buffer.from(`${username}:${password}`).toString("base64")
: undefined;
const response = await fetch(url, {
headers: authHeader ? { Authorization: authHeader } : {},
});
if (!response.ok) {
process.stderr.write(
`Error fetching transcript: ${response.statusText}\n`
);
return null;
}
return await response.text();
} catch (error) {
process.stderr.write(`Failed to fetch transcript: ${error}\n`);
return null;
}
}
export default async function handler(
req: NextApiRequest,
res: NextApiResponse

View File

@@ -3,11 +3,13 @@
import { PrismaClient } from '@prisma/client';
import { PrismaD1 } from '@prisma/adapter-d1';
import { formatError } from './utils/error';
export interface Env {
DB: D1Database;
NEXTAUTH_SECRET?: string;
NEXTAUTH_URL?: string;
WORKER_ENV?: string; // 'development' | 'production'
}
export default {
@@ -208,21 +210,22 @@ export default {
});
} catch (error) {
console.error('Worker error:', error);
console.error('Worker error:', error); // Log full error details, including stack trace
// Use the formatError utility to properly format the error response
const errorPayload = formatError(error, env);
return new Response(
JSON.stringify({
error: 'Internal Server Error',
message: error instanceof Error ? error.message : 'Unknown error',
stack: error instanceof Error ? error.stack : undefined
}),
JSON.stringify(errorPayload),
{
status: 500,
headers: {
'Content-Type': 'application/json',
'Access-Control-Allow-Origin': '*'
},
}
}
);
}
},
};

16
src/utils/error.ts Normal file
View File

@@ -0,0 +1,16 @@
export function formatError(error: unknown, env?: { WORKER_ENV?: string }): Record<string, unknown> {
const payload: Record<string, unknown> = {
error: 'Internal Server Error',
message: error instanceof Error ? error.message : 'Unknown error'
};
// Only include stack trace in development environment
// In Cloudflare Workers, check environment via env parameter
const isDevelopment = env?.WORKER_ENV !== 'production';
if (isDevelopment) {
payload.stack = error instanceof Error ? error.stack : undefined;
}
return payload;
}

36
tests/formatError.test.ts Normal file
View File

@@ -0,0 +1,36 @@
import { test } from 'node:test';
import assert from 'node:assert';
import { formatError } from '../src/utils/error';
const originalEnv = process.env.NODE_ENV;
test('includes stack when not in production', () => {
const err = new Error('boom');
const payload = formatError(err, { WORKER_ENV: 'development' });
assert.ok('stack' in payload);
});
test('omits stack in production', () => {
const err = new Error('boom');
const payload = formatError(err, { WORKER_ENV: 'production' });
assert.ok(!('stack' in payload));
});
test('includes message for all environments', () => {
const err = new Error('boom');
const devPayload = formatError(err, { WORKER_ENV: 'development' });
const prodPayload = formatError(err, { WORKER_ENV: 'production' });
assert.strictEqual(devPayload.message, 'boom');
assert.strictEqual(prodPayload.message, 'boom');
});
test('handles non-Error objects', () => {
const payload = formatError('string error', { WORKER_ENV: 'development' });
assert.strictEqual(payload.message, 'Unknown error');
assert.strictEqual(payload.error, 'Internal Server Error');
});
test.after(() => {
if (originalEnv === undefined) delete process.env.NODE_ENV; else process.env.NODE_ENV = originalEnv;
});