HIGH: Error messages expose internal details

[CPAtoCybersecurity]

Security Finding

Severity: HIGH
Location: src/pages/Settings.js:143, 193
CWE: CWE-209 (Information Exposure Through Error Messages)

Description

Error messages display full exception details to users, potentially exposing:

• Backend structure
• API endpoint details
• Stack traces
• Internal error codes

Current Code

catch (e) {
  toast.error(\`Connection test failed: \${e.message}\`);
  toast.error(\`Failed to save: \${e.message}. Is the backend running?\`);
}

Recommended Fix

1. Use generic error messages for users
2. Log detailed errors server-side only
3. Implement error codes for debugging
4. Never expose stack traces or internal paths

References

• Arcanum Anti-Patterns: Excessive Data Exposure (Priority Release v2.1: Separate Controls & Assessments Tabs with Requirement Mapping #9)
• OWASP: Error Handling

---

Found by Arcanum sec-context security review

[Sarthak-Bhagat2006]

Hi, I would like to work on this issue.
Could you please assign it to me?

[CPAtoCybersecurity]

@Sarthak-Bhagat2006 - Your PR #83 addressed this for Settings.js. Nice work.

There may be other files with similar patterns if you want to continue with this issue. Quick grep for err.message or error.message in toast calls would surface any remaining spots.

Otherwise I can close this as substantially addressed.

[Sarthak-Bhagat2006]

Thank you! I will scan the codebase for similar patterns and submit additional fixes if found.

[Sarthak-Bhagat2006]

I’ve submitted PR #84, which expands the fix to other files where similar patterns were found.
Please let me know if any additional changes are needed.

[Sarthak-Bhagat2006]

Hi @CPAtoCybersecurity
Please let me know if anything else is needed. Thanks!