Skip to content

fix(server): strip stack traces from error responses#154

Closed
ch1lam wants to merge 8 commits into
XiaomiMiMo:mainfrom
ch1lam:fix/error-stack-trace-leak
Closed

fix(server): strip stack traces from error responses#154
ch1lam wants to merge 8 commits into
XiaomiMiMo:mainfrom
ch1lam:fix/error-stack-trace-leak

Conversation

@ch1lam

@ch1lam ch1lam commented Jun 11, 2026

Copy link
Copy Markdown

Summary

  • Use err.message instead of err.stack in the server error handler
  • Prevents leaking internal file paths, dependency versions, and code structure to clients

Motivation

The error handler in packages/opencode/src/server/middleware.ts returned err.stack to the client for unhandled exceptions. Stack traces reveal internal implementation details that aid attackers in reconnaissance.

Changes

// Before
const message = err instanceof Error && err.stack ? err.stack : err.toString()

// After  
const message = err instanceof Error ? err.message : String(err)

The stack trace is still logged server-side via log.error() for debugging purposes.

Fixes #152

qiaozongming and others added 8 commits June 11, 2026 01:23
docs: correct OpenCode repository URL in README files
…-qrcode

docs: update community group chat QR code
The error handler returned err.stack to the client for unhandled
exceptions, leaking internal file paths, dependency versions, and
code structure. Use err.message instead — the stack trace is still
logged server-side for debugging.
@qiaozongming

Copy link
Copy Markdown
Collaborator

#952

@qiaozongming

Copy link
Copy Markdown
Collaborator

#1109

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[SECURITY] Server error responses expose full stack traces to clients

5 participants