Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Server should avoid displaying full path on missing file error #3160

Closed
872342 opened this issue Jul 27, 2023 · 0 comments · Fixed by #3161
Closed

Server should avoid displaying full path on missing file error #3160

872342 opened this issue Jul 27, 2023 · 0 comments · Fixed by #3161
Labels
S-Minor Blocks non-critical functionality, workarounds exist. security T-Defect Bugs, crashes, hangs, security vulnerabilities, or other reported issues.

Comments

@872342
Copy link

872342 commented Jul 27, 2023

Background information

  • Dendrite version or git SHA: Dendrite 0.13.1+a48c7d3
  • SQLite3 or Postgres?: Postgres
  • Running in Docker?: No
  • go version: go1.20.6 linux/amd64
  • Client used (if applicable): N/A

Description

  • What is the problem: Deleting a file or directory from media_store directory results in system path name error
  • Who is affected: Anyone missing files in their media_store dir.
  • How is this bug manifesting: In the HTTP response 404 errcode error
  • When did this first appear: Unknown

Steps to reproduce

  • upload a file to homeserver
  • delete file/directory in media_store directory
  • try to download the file

When trying to request a file which doesn't exist
The response error is a generic "File not found"
{"errcode":"M_NOT_FOUND","error":"File not found"}

But if the file or parent directory no longer exist in the media_store directory, the error includes the full path
{"errcode":"M_NOT_FOUND","error":"Failed to download: os.Open: open /home/user/dendrite/media_store/path/to/file: no such file or directory"}

The response returns to the "File not found" error when the file is removed from the mediaapi_media_repository table and cache is cleared.
But a more generic error message would be better to avoid displaying system info publicly.

@S7evinK S7evinK added security T-Defect Bugs, crashes, hangs, security vulnerabilities, or other reported issues. S-Minor Blocks non-critical functionality, workarounds exist. labels Jul 28, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
S-Minor Blocks non-critical functionality, workarounds exist. security T-Defect Bugs, crashes, hangs, security vulnerabilities, or other reported issues.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants