Skip to content

Taxonomy

Leaky error message

The failure reports something the caller was not meant to learn.

What it looks like

  • An internal exception passed through to a response body.
  • A message that names a file path, a query, a hostname or a key.
  • An error that distinguishes 'no such user' from 'wrong password'.

Why it survives review

A detailed error message is genuinely helpful, and the reviewer is thinking about the engineer who will have to debug this at three in the morning. The audience that matters is the other one — the caller — and nothing in the diff mentions them.

How to see it

  1. For every error that can reach a caller, read it as an attacker would and ask what it teaches.
  2. Log the detail, return the category. Those are two different strings and they should be written as two.
  3. An authentication error that distinguishes between causes is an account enumeration tool.

A minimal pair

Correct

throw new PublicError('Could not sign in');

Defective

throw new PublicError(`No user with email ${email}`);

The response now confirms which email addresses have accounts.

Practise it

1 diff in the corpus carry this class. They are not listed, because knowing which diff contains what would make finding it a comprehension question about this page.

Go to the exercises