liuyu/nofx
1
0
Fork 0
mirror of https://github.com/NoFxAiOS/nofx.git synced 2026-07-09 22:10:57 +08:00
Code Issues Packages Projects Releases Wiki Activity

security: sanitize internal error messages in API responses

Browse Source 
- handler_trader.go: remove loadErr.Error() from 500 responses (2 instances)
- handler_ai_cost.go: replace err.Error() with generic message, add logging
- Internal errors now logged server-side, not exposed to clients
This commit is contained in:
shinchan-zhai
2026-03-23 10:46:22 +08:00
parent c438cc031d
commit 1d0d6f7afd
3 changed files with 12 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
api/handler_trader.go
View File

@@ -495,7 +495,7 @@ func (s *Server) handleStartTrader(c *gin.Context) {
logger.Infof("🔄 Loading trader %s from database...", traderID)
if loadErr := s.traderManager.LoadUserTradersFromStore(s.store, userID); loadErr != nil {
logger.Infof("❌ Failed to load user traders: %v", loadErr)
c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to load trader: " + loadErr.Error()})
c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to load trader configuration"})
return
}
@@ -530,7 +530,8 @@ func (s *Server) handleStartTrader(c *gin.Context) {
}
// Check if there's a specific load error
if loadErr := s.traderManager.GetLoadError(traderID); loadErr != nil {
c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to load trader: " + loadErr.Error()})
logger.Infof("❌ Trader %s load error: %v", traderID, loadErr)
c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to load trader, please check configuration"})
return
}
c.JSON(http.StatusNotFound, gin.H{"error": "Failed to load trader, please check AI model, exchange and strategy configuration"})