error-message-sanitization

name	error-message-sanitization
description	Raw error messages leak internal information to users:
lastReviewed	2026-04-30T00:00:00.000Z

Error Message Sanitization

The Problem

Raw error messages leak internal information to users:

• File paths reveal directory structure
• Stack traces expose code organization
• Internal state shows implementation details
• SDK errors contain connection strings or endpoints

// Bad: leaks internals
catch (err) {
  res.status(500).json({ error: err.message, stack: err.stack });
}

The Solution

Sanitize at system boundaries before returning errors to users.

function sanitizeForUser(error) {
  let msg = error.message || 'An error occurred';
  
  // Strip absolute paths
  msg = msg.replace(/[A-Z]:\\[^\s]+/gi, '[path]');
  msg = msg.replace(/\/(?:home|usr|var|etc)[^\s]+/gi, '[path]');
  
  // Strip stack traces
  msg = msg.replace(/\s+at\s+.+\(.+:\d+:\d+\)/g, '');
  
  // Strip connection strings
  msg = msg.replace(/(?:mongodb|postgresql|mysql|redis):\/\/[^\s]+/gi, '[connection]');
  
  // Strip Azure resource IDs
  msg = msg.replace(/\/subscriptions\/[a-f0-9-]+/gi, '/subscriptions/[id]');
  
  return msg;
}

// Usage
catch (err) {
  console.error('Internal error:', err); // Full error for logs
  res.status(500).json({ 
    error: sanitizeForUser(err),
    requestId: req.id // For support correlation
  });
}

Verification

const testCases = [
  'Failed at C:\\Users\\dev\\project\\src\\api.js:42',
  'Connection failed: mongodb://user:pass@host:27017/db',
  '/subscriptions/abc-123/resourceGroups/prod/...',
  'Error in /home/deploy/app/server.js'
];

testCases.forEach(msg => {
  const sanitized = sanitizeForUser({ message: msg });
  console.log(sanitized);
  // Should not contain actual paths, credentials, or resource IDs
});

When to Apply

• REST API error responses
• GraphQL error messages
• WebSocket error events
• Any user-facing error display

Tags

security error-handling api privacy