5 Commits

Author SHA1 Message Date
bb078b4d6a Fix error handling to properly use formatError utility and improve environment detection
- Actually use the formatError function in the error handling code
- Update formatError function to accept env parameter for Cloudflare Workers
- Improve environment detection to use WORKER_ENV instead of process.env
- Update tests to match new function signature
- Add comprehensive test coverage for error formatting
- Fix linting issues and ensure proper TypeScript types
2025-06-10 00:46:21 +02:00
33577bb2d5 Potential fix for code scanning alert no. 6: Information exposure through a stack trace
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
2025-06-10 00:35:27 +02:00
adea8ae6b7 Refactor error payload logic 2025-06-10 00:27:54 +02:00
ef8601dd72 chore: secure error response 2025-06-10 00:17:24 +02:00
5aaca6de99 Potential fix for code scanning alert no. 2: Workflow does not contain permissions (#6)
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
2025-06-10 00:11:10 +02:00
4 changed files with 64 additions and 7 deletions

View File

@ -1,4 +1,6 @@
name: Playwright Tests
permissions:
contents: read
on:
push:
branches: [main, master]

View File

@ -3,11 +3,13 @@
import { PrismaClient } from '@prisma/client';
import { PrismaD1 } from '@prisma/adapter-d1';
import { formatError } from './utils/error';
export interface Env {
DB: D1Database;
NEXTAUTH_SECRET?: string;
NEXTAUTH_URL?: string;
WORKER_ENV?: string; // 'development' | 'production'
}
export default {
@ -208,21 +210,22 @@ export default {
});
} catch (error) {
console.error('Worker error:', error);
console.error('Worker error:', error); // Log full error details, including stack trace
// Use the formatError utility to properly format the error response
const errorPayload = formatError(error, env);
return new Response(
JSON.stringify({
error: 'Internal Server Error',
message: error instanceof Error ? error.message : 'Unknown error',
stack: error instanceof Error ? error.stack : undefined
}),
JSON.stringify(errorPayload),
{
status: 500,
headers: {
'Content-Type': 'application/json',
'Access-Control-Allow-Origin': '*'
},
}
}
);
}
},
};

16
src/utils/error.ts Normal file
View File

@ -0,0 +1,16 @@
export function formatError(error: unknown, env?: { WORKER_ENV?: string }): Record<string, unknown> {
const payload: Record<string, unknown> = {
error: 'Internal Server Error',
message: error instanceof Error ? error.message : 'Unknown error'
};
// Only include stack trace in development environment
// In Cloudflare Workers, check environment via env parameter
const isDevelopment = env?.WORKER_ENV !== 'production';
if (isDevelopment) {
payload.stack = error instanceof Error ? error.stack : undefined;
}
return payload;
}

36
tests/formatError.test.ts Normal file
View File

@ -0,0 +1,36 @@
import { test } from 'node:test';
import assert from 'node:assert';
import { formatError } from '../src/utils/error';
const originalEnv = process.env.NODE_ENV;
test('includes stack when not in production', () => {
const err = new Error('boom');
const payload = formatError(err, { WORKER_ENV: 'development' });
assert.ok('stack' in payload);
});
test('omits stack in production', () => {
const err = new Error('boom');
const payload = formatError(err, { WORKER_ENV: 'production' });
assert.ok(!('stack' in payload));
});
test('includes message for all environments', () => {
const err = new Error('boom');
const devPayload = formatError(err, { WORKER_ENV: 'development' });
const prodPayload = formatError(err, { WORKER_ENV: 'production' });
assert.strictEqual(devPayload.message, 'boom');
assert.strictEqual(prodPayload.message, 'boom');
});
test('handles non-Error objects', () => {
const payload = formatError('string error', { WORKER_ENV: 'development' });
assert.strictEqual(payload.message, 'Unknown error');
assert.strictEqual(payload.error, 'Internal Server Error');
});
test.after(() => {
if (originalEnv === undefined) delete process.env.NODE_ENV; else process.env.NODE_ENV = originalEnv;
});