[mansur-codes]

fix(security): sanitize internal 500 error responses and WebSocket payloads (#260)

Summary

Remediates an internal error leakage vulnerability where unhandled exceptions and database driver errors (such as Postgres connection strings containing sensitive credentials) were interpolated directly into HTTP 500 responses and WebSocket error payloads for unauthenticated callers.

Key Changes

1. Unified Safe Internal Error Handling (src/errors.ts):
   • Introduced INTERNAL_ERROR_CODE = 'internal_error' and canonical INTERNAL_ERROR_MESSAGE = 'An internal server error occurred.'.
   • Added sendInternalError() helper and createInternalErrorBody() returning sanitized deterministic payloads with correlation IDs:

     {
       "code": "internal_error",
       "message": "An internal server error occurred.",
       "correlationId": "<id>"
     }

   • Captures correlation ID from x-correlation-id / x-request-id headers or Fastify req.id (with fallback to randomUUID()).
   • Logs real error objects, stack traces, and correlation IDs via the server's structured logger before sanitizing the response.
2. Global & Route-Level Remediation:
   • Configured genReqId: () => randomUUID() and app.setErrorHandler in src/app.ts to guarantee all unhandled 500 errors across the application return the sanitized envelope.
   • Replaced raw exception interpolations in src/routes/benchmark.ts, src/routes/spreads.ts, src/routes/volumes.ts, and src/routes/snapshot.ts.
   • Updated src/api/websocket.ts to emit matching safe error structures (type: 'error', code: 'internal_error', fixed message, correlationId) during verification failures.
3. OpenAPI Specification:
   • Updated openapi.yaml with InternalErrorResponse schema and InternalServerError component.
   • Documented 500 response schema for /benchmark/{asset}, /spreads/{asset}, /volumes/{asset}, and /snapshot.
   • Regenerated openapi.json via npm run openapi:gen.
4. Automated Testing:
   • Added comprehensive tests in src/__tests__/internalErrorMasking.test.ts verifying that injected database errors with sensitive connection strings (postgres://user:supersecretpassword@localhost:5432/db) return HTTP 500 with code: "internal_error", a correlation ID, and zero leaked credentials in HTTP bodies or WebSocket payloads, while ensuring the server logger records the real error and correlation ID.
   • Updated existing test suites (spreads.test.ts, volumes.test.ts, snapshot.test.ts) to assert the new safe contract.

Related issue

Closes #260

Type of change

• Bug fix
• New feature
• Refactor
• Docs
• Tests
• CI / tooling

Checklist

• I have read CONTRIBUTING.md
• npx tsc --noEmit passes
• npm run build passes
• I added / updated tests where relevant
• I updated docs where relevant

[drips-wave]

@mansur-codes Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits