liuyu/nofx
1
0
Fork 0
mirror of https://github.com/NoFxAiOS/nofx.git synced 2026-07-07 04:50:57 +08:00
Code Issues Packages Projects Releases Wiki Activity

security: sanitize internal error messages in API responses

Browse Source 
- handler_trader.go: remove loadErr.Error() from 500 responses (2 instances)
- handler_ai_cost.go: replace err.Error() with generic message, add logging
- Internal errors now logged server-side, not exposed to clients
This commit is contained in:
shinchan-zhai
2026-03-23 10:46:22 +08:00
parent c438cc031d
commit 1d0d6f7afd
3 changed files with 12 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
api/handler_ai_cost.go
View File

@@ -2,6 +2,7 @@ package api
import (
"net/http"
"nofx/logger"
"github.com/gin-gonic/gin"
)
@@ -18,7 +19,8 @@ func (s *Server) handleGetAICosts(c *gin.Context) {
charges, total, err := s.store.AICharge().GetCharges(traderID, period)
if err != nil {
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
logger.Infof("❌ Failed to get AI charges for trader %s: %v", traderID, err)
c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to retrieve AI cost data"})
return
}

5
api/handler_trader.go
View File

@@ -495,7 +495,7 @@ func (s *Server) handleStartTrader(c *gin.Context) {
logger.Infof("🔄 Loading trader %s from database...", traderID)
if loadErr := s.traderManager.LoadUserTradersFromStore(s.store, userID); loadErr != nil {
logger.Infof("❌ Failed to load user traders: %v", loadErr)
c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to load trader: " + loadErr.Error()})
c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to load trader configuration"})
return
}
@@ -530,7 +530,8 @@ func (s *Server) handleStartTrader(c *gin.Context) {
}
// Check if there's a specific load error
if loadErr := s.traderManager.GetLoadError(traderID); loadErr != nil {
c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to load trader: " + loadErr.Error()})
logger.Infof("❌ Trader %s load error: %v", traderID, loadErr)
c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to load trader, please check configuration"})
return
}
c.JSON(http.StatusNotFound, gin.H{"error": "Failed to load trader, please check AI model, exchange and strategy configuration"})

8
nofxi-tasks.md
View File

@@ -44,11 +44,15 @@
## Pending
### Security
- [PENDING] Investigate GitHub Dependabot's 21 reported vulnerabilities (13 high, 7 moderate, 1 low)
- [DONE] Upgrade go-ethereum v1.16.7→v1.16.8 (fixes 3 vulns: GO-2026-4508, GO-2026-4314, GO-2026-4315)
- [DONE] Upgrade golang-jwt/jwt v5.2.0→v5.2.2 (fixes GO-2025-3553 memory alloc DoS)
- [DONE] Upgrade quic-go v0.54.0→v0.57.0 (fixes GO-2025-4233 HTTP/3 QPACK DoS)
- [PENDING] 3 stdlib vulns remain (GO-2026-4599/4600/4601) — need Go 1.26.1 upgrade (currently on 1.26.0)
- [PENDING] GitHub Dependabot still reports 21 vulns — some may be transitive/test-only, needs further triage
### Code Quality
- [DONE] Extract WelcomeScreen, ChatMessages, ChatInput from AgentChatPage (825→480 lines)
- [PENDING] `context.Background()` used in ~69 exchange/trader calls — should propagate request context for proper cancellation (partially done: kline handlers fixed, trader/exchange calls remain)
- [PENDING] `AgentChatPage.tsx` is 825 lines — could still extract WelcomeScreen and ChatMessages components
### Performance
- [PENDING] `gatherContext` in agent.go iterates all traders and positions on every message — consider caching (low priority: only triggered per user message)