Stop reproducing file-upload field values in config decode errors

pkg/field/decode_hooks.go

@@ -2,7 +2,9 @@ package field
 
 import (
 	"encoding/base64"
+	"errors"
 	"fmt"
+	"io/fs"
 	"net/url"
 	"os"
 	"reflect"
@@ -75,7 +77,7 @@ func getFileContentFromPath(path string) ([]byte, error) {
 	// Check if the file exists
 	fileInfo, err := os.Stat(path)
 	if err != nil {
-		return nil, fmt.Errorf("cannot access file: %w", err)
+		return nil, fmt.Errorf("cannot access file: %w", redactPathError(err))
 	}
 
 	// Check file size limit (2MB)
@@ -87,11 +89,19 @@ func getFileContentFromPath(path string) ([]byte, error) {
 	// Read the file
 	content, err := os.ReadFile(path)
 	if err != nil {
-		return nil, fmt.Errorf("error reading file: %w", err)
+		return nil, fmt.Errorf("error reading file: %w", redactPathError(err))
 	}
 	return content, nil
 }
 
+func redactPathError(err error) error {
+	var pathErr *fs.PathError
+	if errors.As(err, &pathErr) {
+		return pathErr.Err
+	}
+	return err
+}
+
 // parseFileContent returns the file upload content from a string field value.
 func parseFileContent(data string) ([]byte, error) {
 	if data == "" {
@@ -118,6 +128,10 @@ func parseFileContent(data string) ([]byte, error) {
 func parseJSONBase64DataURL(dataURL string) ([]byte, error) {
 	parsedURL, err := url.Parse(dataURL)
 	if err != nil {
+		var urlErr *url.Error
+		if errors.As(err, &urlErr) {
+			return nil, fmt.Errorf("invalid data URL: %w", urlErr.Err)
+		}
 		return nil, fmt.Errorf("invalid data URL: %w", err)
 	}
 

pkg/field/decode_hooks_test.go

@@ -11,6 +11,53 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+// TestFileUploadDecodeHook_DoesNotLeakValueInErrors guards against
+// regressions of CE-1284: the field's value (which may be secret file
+// content, not an actual path) must never be reproduced in a decode error.
+func TestFileUploadDecodeHook_DoesNotLeakValueInErrors(t *testing.T) {
+	tempDir := t.TempDir()
+
+	t.Run("stat failure on a secret-like value does not echo it", func(t *testing.T) {
+		secret := "TOTALLY-SECRET-VALUE-THAT-MUST-NOT-LEAK"
+
+		_, err := mapstructure.DecodeHookExec(
+			FileUploadDecodeHook(true),
+			reflect.ValueOf(secret),
+			reflect.ValueOf([]byte{}),
+		)
+		require.Error(t, err)
+		require.NotContains(t, err.Error(), secret)
+	})
+
+	t.Run("read failure on a directory does not echo its name", func(t *testing.T) {
+		secretDirName := "TOTALLY-SECRET-DIR-NAME"
+		secretDir := filepath.Join(tempDir, secretDirName)
+		require.NoError(t, os.Mkdir(secretDir, 0700))
+
+		_, err := mapstructure.DecodeHookExec(
+			FileUploadDecodeHook(true),
+			reflect.ValueOf(secretDir),
+			reflect.ValueOf([]byte{}),
+		)
+		require.Error(t, err)
+		require.NotContains(t, err.Error(), secretDirName)
+	})
+
+	t.Run("invalid data URL does not echo the payload", func(t *testing.T) {
+		secret := "SECRET\x00PAYLOAD-THAT-MUST-NOT-LEAK"
+		dataURL := "data:application/json;base64," + secret
+
+		_, err := mapstructure.DecodeHookExec(
+			FileUploadDecodeHook(false),
+			reflect.ValueOf(dataURL),
+			reflect.ValueOf([]byte{}),
+		)
+		require.Error(t, err)
+		require.NotContains(t, err.Error(), secret)
+		require.NotContains(t, err.Error(), "PAYLOAD-THAT-MUST-NOT-LEAK")
+	})
+}
+
 func TestFileUploadDecodeHook(t *testing.T) {
 	// Create a temporary file for testing
 	tempDir := t.TempDir()