Skip to content

fix(sbi): avoid leaking Go types in malformed request errors - #237

Merged
Alonza0314 merged 2 commits into
free5gc:mainfrom
wiwi878:fix/amf-sbi-error-detail
Aug 20, 2026
Merged

fix(sbi): avoid leaking Go types in malformed request errors#237
Alonza0314 merged 2 commits into
free5gc:mainfrom
wiwi878:fix/amf-sbi-error-detail

Conversation

@wiwi878

@wiwi878 wiwi878 commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

Related issue

This PR fixes free5gc/free5gc#1128, where malformed SBI request responses expose internal Go model names in ProblemDetails.detail.

Summary

When AMF receives a malformed SBI request body, the error response can expose internal Go model names such as models.AssignEbiData.

This change:

  • replaces the exposed parser error with a generic client-facing message;
  • keeps the detailed deserialization error in the AMF log;
  • returns 400 Bad Request with cause: INVALID_MSG_FORMAT;
  • sets the response media type to application/problem+json.

The fix covers the Namf_Communication handlers from #1128 and the same error pattern in Namf_Location, Namf_EventExposure, and AMF callback handlers.

Testing

  • go test ./internal/sbi/... passes.
  • go test ./... is currently affected by an unrelated timing-sensitive failure in internal/context/TestTimerStartAndStop: the test expected 3 expirations but observed fewer.

Fixes free5gc/free5gc#1128

@d11nn d11nn left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @wiwi878,
It seems internal/sbi/api_location.go was missed in this PR. It still has the same pattern in HTTPProvideLocationInfo:

err = openapi. Deserialize(&requestLocInfo, requestBody, "application/json")
if err != nil {
  problemDetail := "[Request Body] " + err. Error() // Still exposes Go struct name
  ... 

Could you also update HTTPProvideLocationInfo in api_location.go with the same fix?

Optional suggestion: Since this error-handling block is now duplicated across ~17 handlers in communication, eventexposure, callback, and location, it might also be worth extracting it into a common helper function in internal/sbi to keep the code clean and avoid missing endpoints in the future

@wiwi878
wiwi878 force-pushed the fix/amf-sbi-error-detail branch from e510b9d to 81f0468 Compare August 20, 2026 05:54
@wiwi878
wiwi878 requested a review from d11nn August 20, 2026 06:17

@d11nn d11nn left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Alonza0314
Alonza0314 merged commit 4b4cbb9 into free5gc:main Aug 20, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bugs] AMF: verbose deserialization errors expose internal Go struct names (GHSA-xw5p-5pgh-4xq5)

3 participants