From de3a1c7ddbcc02d025e574eed3441ed9f06ecbe4 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Sat, 23 May 2026 04:55:22 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[MEDIUM]=20?=
 =?UTF-8?q?Fix=20Cloudinary=20error=20data=20leak=20in=20upload=20API?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: GerryK97 <210032986+GerryK97@users.noreply.github.com>
---
 .jules/sentinel.md          | 5 +++++
 src/app/api/upload/route.ts | 9 +++++----
 2 files changed, 10 insertions(+), 4 deletions(-)
 create mode 100644 .jules/sentinel.md

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 00000000..a629cb2c
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,5 @@
+
+## 2024-05-30 - Cloudinary Error Data Leak in Upload Route
+**Vulnerability:** The `/api/upload` endpoint leaked detailed internal Cloudinary API errors (e.g. `cloudinaryError` object, `http_code`) in the JSON response when an image upload failed.
+**Learning:** Detailed error logging was mixed with client response construction, causing internal service data (and potential configuration hints) to be exposed to external clients in the case of failure.
+**Prevention:** Always separate internal logging from client-facing error messages. Catch blocks handling external APIs (like Cloudinary) should log full details via `console.error` on the server but return only generic, safe messages (e.g., "Failed to upload image") to the client.
diff --git a/src/app/api/upload/route.ts b/src/app/api/upload/route.ts
index 1664e115..797ab55f 100644
--- a/src/app/api/upload/route.ts
+++ b/src/app/api/upload/route.ts
@@ -60,18 +60,19 @@ export async function POST(request: NextRequest) {
   } catch (error: any) {
     console.error('Upload error:', error);
 
-    // Return detailed error message
+    // Security: Do not expose detailed Cloudinary error responses to the client.
+    // Instead, log the full error server-side and return a generic safe message.
     const errorMessage = error?.message || error?.error?.message || 'Failed to upload image';
-    const errorDetails = {
+    const fullErrorDetails = {
       error: errorMessage,
       details: error?.http_code ? `HTTP ${error.http_code}` : undefined,
       cloudinaryError: error?.error || undefined
     };
 
-    console.error('Full error details:', errorDetails);
+    console.error('Full error details:', fullErrorDetails);
 
     return NextResponse.json(
-      errorDetails,
+      { error: 'Failed to upload image' },
       { status: 500 }
     );
   }