Any concern render.JSON() can leak internal errors to outside?
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 30/100
Research direction
Review responder.go around line 98 and the render.JSON() error path first. Determine whether direct encoding errors can expose internal details, then define and validate a safer behavior or API change; done when the information-leak concern is resolved.
Written by the indexing model from the issue text.
Description
Hi, the JSON rendering code seems to expose direct encoding errors to outside
https://github.com/go-chi/render/blob/master/responder.go#L98
if err := enc.Encode(v); err != nil {
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
would it be better to add another function argument to render.JSON() or something, rather than exposing library error messages?
- Dominant language
- Go
- Stars
- 341
- Forks
- 68
- PR merge metrics
- No merged PRs in 30d
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from go-chi/render
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
-
Difficulty 5/5 Over a week Newbie friendliness 10/100
-
render.Render() writes to writer unexpected data of aliased typePossibly taken @team-humaki claimed this 47 days ago. Open
Difficulty 3/5 1-2 days Newbie friendliness 35/100
Similar issues
-
fix(scan): validate and normalize output format in validate-contractPossibly taken @WKr1shna claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
bug good first issue help wanted
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
Won't Fix
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
microsoft/TypeScript#65107 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 78/100
argoproj/argo-workflows#17397 ·
Maintainers usually reply within 1 day