fix: return generic error details on AMF deserialization failures - #235
Merged
Alonza0314 merged 2 commits intoAug 18, 2026
Merged
Conversation
|
Hi @arccat-114 , |
Use httptest.NewRequestWithContext to satisfy the noctx linter rule.
arccat-114
force-pushed
the
fix/amf-deserialization-error-disclosure
branch
from
August 17, 2026 06:16
7769c71 to
c3f4eaa
Compare
|
@Alonza0314 LGTM |
d11nn
approved these changes
Aug 18, 2026
Member
|
@arccat-114 Thanks for your improvement on error handling. How about using this statement: fmt.Sprintf("xxxxx: %v\n", err)Which will make the error message be clear as expected and also show the original error message for debug. |
This comment was marked as outdated.
This comment was marked as outdated.
Address review feedback: use fmt.Sprintf to log the deserialize failure with context while keeping the original error, and keep the client-facing detail generic.
Contributor
Author
|
Follow-up: I went ahead and switched the log lines to |
|
@Alonza0314 LGTM |
Member
|
OK, I see. It looks good to me now. |
Alonza0314
approved these changes
Aug 18, 2026
Member
|
@arccat-114 Thanks again for your contribution. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1128
Summary
Nine handlers in
internal/sbi/api_communication.go(HTTPAMFStatusChangeSubscribeModify,HTTPCreateUEContext,HTTPEBIAssignment,HTTPRegistrationStatusUpdate,HTTPReleaseUEContext,HTTPUEContextTransfer,HTTPN1N2MessageTransfer,HTTPN1N2MessageSubscribe,HTTPAMFStatusChangeSubscribe) returned the raw Goerror.Error()string in theDetailfield of theProblemDetailsresponse on deserialization failure, exposing fully-qualified internal Go struct names to the client (GHSA-xw5p-5pgh-4xq5).Changes
Keep the detailed error in the server log (unchanged) and return fixed client-facing messages instead:
"Failed to read request body""Failed to deserialize request body"Validation
TestDeserializeErrorsDoNotLeakInternalscovering all nine handlers: a truncated JSON body gets a 400 whose detail is the generic message. Before this fix the detail carried the raw deserialization error (red), with the fix it is the fixed message (green).go test ./internal/sbi/: ok;go vet/gofmt: clean.