🛡️ Sentinel: [CRITICAL] Fix Information Disclosure Vulnerabilities

.jules/sentinel.md

@@ -0,0 +1,4 @@
+## 2024-05-16 - Prevent Exposure of Internal Configuration and Service Errors
+**Vulnerability:** The application had an unauthenticated debug endpoint (`src/app/debug/route.ts`) that leaked environment variables, including parts of `MONGODB_URI` and the status of `NEXTAUTH_SECRET`. Additionally, the `/api/upload` endpoint exposed internal configuration states (whether Cloudinary environment variables were set) and detailed Cloudinary service errors (`cloudinaryError`) in its JSON responses.
+**Learning:** Returning detailed error messages and configuration states in API responses directly to clients can provide attackers with valuable intelligence about the application's infrastructure, dependencies, and internal setup, facilitating further attacks.
+**Prevention:** Ensure that all API responses return generic, sanitized error messages (e.g., "Internal server error") to clients. Keep detailed error information, stack traces, and configuration states restricted to secure, internal server logs. Regularly review and remove debug endpoints before deploying to production.

src/app/api/upload/route.ts

@@ -12,7 +12,7 @@ export async function POST(request: NextRequest) {
         api_secret: !!process.env.CLOUDINARY_API_SECRET
       });
       return NextResponse.json(
-        { error: 'Cloudinary is not configured. Please set environment variables.' },
+        { error: 'Internal server error' },
         { status: 500 }
       );
     }
@@ -60,7 +60,7 @@ export async function POST(request: NextRequest) {
   } catch (error: any) {
     console.error('Upload error:', error);
 
-    // Return detailed error message
+    // Return generic error message to client, log details to server
     const errorMessage = error?.message || error?.error?.message || 'Failed to upload image';
     const errorDetails = {
       error: errorMessage,
@@ -71,7 +71,7 @@ export async function POST(request: NextRequest) {
     console.error('Full error details:', errorDetails);
 
     return NextResponse.json(
-      errorDetails,
+      { error: 'Internal server error' },
       { status: 500 }
     );
   }