Server error responses leak internal file paths to clients #29

New issue

Open

opened 2026-05-17 23:13:24 +02:00 by heiko · 1 comment

heiko commented

2026-05-17 23:13:24 +02:00

Owner

Summary

Several places in cmd/cert-proxy-server/serve.go pass raw Go OS errors directly to http.Error:

http.Error(w, err.Error(), http.StatusInternalServerError)

Go's os.Open errors include the full file path, e.g.:

open /var/lib/cert-proxy/certs/unknown.com/cert.pem: no such file or directory

This tells any client (including unauthenticated ones on public endpoints) the exact on-disk layout of the certbase.

Fix

Log the detailed error server-side and return a generic message to the client:

log.Printf("serving %s: %v", fn, err)
http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)

## Summary Several places in `cmd/cert-proxy-server/serve.go` pass raw Go OS errors directly to `http.Error`: ```go http.Error(w, err.Error(), http.StatusInternalServerError) ``` Go's `os.Open` errors include the full file path, e.g.: ``` open /var/lib/cert-proxy/certs/unknown.com/cert.pem: no such file or directory ``` This tells any client (including unauthenticated ones on public endpoints) the exact on-disk layout of the certbase. ## Fix Log the detailed error server-side and return a generic message to the client: ```go log.Printf("serving %s: %v", fn, err) http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError) ```

heiko added the

security

label

2026-05-17 23:13:24 +02:00

heiko referenced this issue from a commit

2026-05-20 19:44:19 +02:00

test: add regression for CN path separator (#31)

heiko referenced this issue

2026-05-20 19:44:43 +02:00

fix: reject client CN containing path separator (#31) #37

heiko commented

2026-05-22 11:38:23 +02:00