Skip to content

🛡️ Sentinel: [MEDIUM] Fix Information Exposure via RPC Errors #76

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
DerUntote wants to merge 1 commit into
base: master
Choose a base branch
from
Open

🛡️ Sentinel: [MEDIUM] Fix Information Exposure via RPC Errors #76

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .jules/sentinel.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@

## 2024-06-26 - [MEDIUM] Fix Information Exposure via RPC Errors
**Vulnerability:** The application was passing unhandled RPC connection errors directly to users via Discord messages (`message.reply(err.message)`).
**Learning:** This could leak internal daemon/network information or server configurations if an attacker forced an error state or an unexpected network exception occurred. Discord message limitations must also be considered; raw stack traces can lead to unintended command failures.
**Prevention:** Avoid passing raw `err.message` objects from backend/RPC providers to untrusted clients. Catch and log the detailed errors internally (`console.error(err)`), and provide a safe, generic fallback message to the user (`"An error occurred..."`).
24 changes: 21 additions & 3 deletions bot/modules/dogeTipper.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,7 +158,13 @@ function doWithdraw(message, tipper, words, helpmsg) {
}
doge.sendFrom(tipper, address, Number(amount), function (err, txId) {
if (err) {
message.reply(err.message).then((message) => message.delete(10000));
console.error(err);
// 🛡️ Sentinel: Securely log internal error
message
.reply(
'An error occurred during the transaction. Please try again later.',
)
.then((msg) => msg.delete(10000).catch(() => {})); // 🛡️ Sentinel: Avoid leaking RPC error details
} else {
message.channel.send({
embed: {
Expand Down Expand Up @@ -263,7 +269,13 @@ function doTip(bot, message, tipper, words, helpmsg) {
function sendDOGE(bot, message, tipper, recipient, amount, privacyFlag) {
getAddress(recipient.toString(), function (err, address) {
if (err) {
message.reply(err.message).then((message) => message.delete(10000));
console.error(err);
// 🛡️ Sentinel: Securely log internal error
message
.reply(
'An error occurred during the transaction. Please try again later.',
)
.then((msg) => msg.delete(10000).catch(() => {})); // 🛡️ Sentinel: Avoid leaking RPC error details
} else {
doge.sendFrom(
tipper,
Expand All @@ -274,7 +286,13 @@ function sendDOGE(bot, message, tipper, recipient, amount, privacyFlag) {
null,
function (err, txId) {
if (err) {
message.reply(err.message).then((message) => message.delete(10000));
console.error(err);
// 🛡️ Sentinel: Securely log internal error
message
.reply(
'An error occurred during the transaction. Please try again later.',
)
.then((msg) => msg.delete(10000).catch(() => {})); // 🛡️ Sentinel: Avoid leaking RPC error details
} else {
if (privacyFlag) {
let userProfile = message.guild.members.get(recipient); // ⚡ Bolt: O(1) direct ID lookup vs O(N) linear search;
Expand Down
12 changes: 9 additions & 3 deletions bot/modules/exampleTipper.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,7 +143,9 @@ function doWithdraw(message, tipper, words, helpmsg) {
}
ltc.sendFrom(tipper, address, Number(amount), function(err, txId) {
if (err) {
message.reply(err.message).then(message => message.delete(10000));
console.error(err);
// 🛡️ Sentinel: Securely log internal error
message.reply("An error occurred during the transaction. Please try again later.").then((msg) => msg.delete(10000).catch(() => {})); // 🛡️ Sentinel: Avoid leaking RPC error details
} else {
message.channel.send({embed:{
title: '**:outbox_tray::money_with_wings::moneybag:Litecoin (LTC) Transaction Completed!:moneybag::money_with_wings::outbox_tray:**',
Expand Down Expand Up @@ -228,11 +230,15 @@ function doTip(bot, message, tipper, words, helpmsg) {
function sendLTC(bot, message, tipper, recipient, amount, privacyFlag) {
getAddress(recipient.toString(), function(err, address) {
if (err) {
message.reply(err.message).then(message => message.delete(10000));
console.error(err);
// 🛡️ Sentinel: Securely log internal error
message.reply("An error occurred during the transaction. Please try again later.").then((msg) => msg.delete(10000).catch(() => {})); // 🛡️ Sentinel: Avoid leaking RPC error details
} else {
ltc.sendFrom(tipper, address, Number(amount), 1, null, null, function(err, txId) {
if (err) {
message.reply(err.message).then(message => message.delete(10000));
console.error(err);
// 🛡️ Sentinel: Securely log internal error
message.reply("An error occurred during the transaction. Please try again later.").then((msg) => msg.delete(10000).catch(() => {})); // 🛡️ Sentinel: Avoid leaking RPC error details
} else {
if (privacyFlag) {
let userProfile = message.guild.members.get(recipient) // ⚡ Bolt: O(1) direct ID lookup vs O(N) linear search;
Expand Down
24 changes: 21 additions & 3 deletions bot/modules/ftcTipper.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,7 +158,13 @@ function doWithdraw(message, tipper, words, helpmsg) {
}
ftc.sendFrom(tipper, address, Number(amount), function (err, txId) {
if (err) {
message.reply(err.message).then((message) => message.delete(10000));
console.error(err);
// 🛡️ Sentinel: Securely log internal error
message
.reply(
'An error occurred during the transaction. Please try again later.',
)
.then((msg) => msg.delete(10000).catch(() => {})); // 🛡️ Sentinel: Avoid leaking RPC error details
} else {
message.channel.send({
embed: {
Expand Down Expand Up @@ -263,7 +269,13 @@ function doTip(bot, message, tipper, words, helpmsg) {
function sendFTC(bot, message, tipper, recipient, amount, privacyFlag) {
getAddress(recipient.toString(), function (err, address) {
if (err) {
message.reply(err.message).then((message) => message.delete(10000));
console.error(err);
// 🛡️ Sentinel: Securely log internal error
message
.reply(
'An error occurred during the transaction. Please try again later.',
)
.then((msg) => msg.delete(10000).catch(() => {})); // 🛡️ Sentinel: Avoid leaking RPC error details
} else {
ftc.sendFrom(
tipper,
Expand All @@ -274,7 +286,13 @@ function sendFTC(bot, message, tipper, recipient, amount, privacyFlag) {
null,
function (err, txId) {
if (err) {
message.reply(err.message).then((message) => message.delete(10000));
console.error(err);
// 🛡️ Sentinel: Securely log internal error
message
.reply(
'An error occurred during the transaction. Please try again later.',
)
.then((msg) => msg.delete(10000).catch(() => {})); // 🛡️ Sentinel: Avoid leaking RPC error details
} else {
if (privacyFlag) {
let userProfile = message.guild.members.get(recipient); // ⚡ Bolt: O(1) direct ID lookup vs O(N) linear search;
Expand Down
24 changes: 21 additions & 3 deletions bot/modules/lbcTipper.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,7 +158,13 @@ function doWithdraw(message, tipper, words, helpmsg) {
}
lbc.sendFrom(tipper, address, Number(amount), function (err, txId) {
if (err) {
message.reply(err.message).then((message) => message.delete(10000));
console.error(err);
// 🛡️ Sentinel: Securely log internal error
message
.reply(
'An error occurred during the transaction. Please try again later.',
)
.then((msg) => msg.delete(10000).catch(() => {})); // 🛡️ Sentinel: Avoid leaking RPC error details
} else {
message.channel.send({
embed: {
Expand Down Expand Up @@ -263,7 +269,13 @@ function doTip(bot, message, tipper, words, helpmsg) {
function sendLBC(bot, message, tipper, recipient, amount, privacyFlag) {
getAddress(recipient.toString(), function (err, address) {
if (err) {
message.reply(err.message).then((message) => message.delete(10000));
console.error(err);
// 🛡️ Sentinel: Securely log internal error
message
.reply(
'An error occurred during the transaction. Please try again later.',
)
.then((msg) => msg.delete(10000).catch(() => {})); // 🛡️ Sentinel: Avoid leaking RPC error details
} else {
lbc.sendFrom(
tipper,
Expand All @@ -274,7 +286,13 @@ function sendLBC(bot, message, tipper, recipient, amount, privacyFlag) {
null,
function (err, txId) {
if (err) {
message.reply(err.message).then((message) => message.delete(10000));
console.error(err);
// 🛡️ Sentinel: Securely log internal error
message
.reply(
'An error occurred during the transaction. Please try again later.',
)
.then((msg) => msg.delete(10000).catch(() => {})); // 🛡️ Sentinel: Avoid leaking RPC error details
} else {
if (privacyFlag) {
let userProfile = message.guild.members.get(recipient); // ⚡ Bolt: O(1) direct ID lookup vs O(N) linear search;
Expand Down
24 changes: 21 additions & 3 deletions bot/modules/protonTipper.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,7 +158,13 @@ function doWithdraw(message, tipper, words, helpmsg) {
}
proton.sendFrom(tipper, address, Number(amount), function (err, txId) {
if (err) {
message.reply(err.message).then((message) => message.delete(10000));
console.error(err);
// 🛡️ Sentinel: Securely log internal error
message
.reply(
'An error occurred during the transaction. Please try again later.',
)
.then((msg) => msg.delete(10000).catch(() => {})); // 🛡️ Sentinel: Avoid leaking RPC error details
} else {
message.channel.send({
embed: {
Expand Down Expand Up @@ -263,7 +269,13 @@ function doTip(bot, message, tipper, words, helpmsg) {
function sendPROTON(bot, message, tipper, recipient, amount, privacyFlag) {
getAddress(recipient.toString(), function (err, address) {
if (err) {
message.reply(err.message).then((message) => message.delete(10000));
console.error(err);
// 🛡️ Sentinel: Securely log internal error
message
.reply(
'An error occurred during the transaction. Please try again later.',
)
.then((msg) => msg.delete(10000).catch(() => {})); // 🛡️ Sentinel: Avoid leaking RPC error details
} else {
proton.sendFrom(
tipper,
Expand All @@ -274,7 +286,13 @@ function sendPROTON(bot, message, tipper, recipient, amount, privacyFlag) {
null,
function (err, txId) {
if (err) {
message.reply(err.message).then((message) => message.delete(10000));
console.error(err);
// 🛡️ Sentinel: Securely log internal error
message
.reply(
'An error occurred during the transaction. Please try again later.',
)
.then((msg) => msg.delete(10000).catch(() => {})); // 🛡️ Sentinel: Avoid leaking RPC error details
} else {
if (privacyFlag) {
let userProfile = message.guild.members.get(recipient); // ⚡ Bolt: O(1) direct ID lookup vs O(N) linear search;
Expand Down
24 changes: 21 additions & 3 deletions bot/modules/pxcTipper.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,7 +158,13 @@ function doWithdraw(message, tipper, words, helpmsg) {
}
pxc.sendFrom(tipper, address, Number(amount), function (err, txId) {
if (err) {
message.reply(err.message).then((message) => message.delete(10000));
console.error(err);
// 🛡️ Sentinel: Securely log internal error
message
.reply(
'An error occurred during the transaction. Please try again later.',
)
.then((msg) => msg.delete(10000).catch(() => {})); // 🛡️ Sentinel: Avoid leaking RPC error details
} else {
message.channel.send({
embed: {
Expand Down Expand Up @@ -263,7 +269,13 @@ function doTip(bot, message, tipper, words, helpmsg) {
function sendPXC(bot, message, tipper, recipient, amount, privacyFlag) {
getAddress(recipient.toString(), function (err, address) {
if (err) {
message.reply(err.message).then((message) => message.delete(10000));
console.error(err);
// 🛡️ Sentinel: Securely log internal error
message
.reply(
'An error occurred during the transaction. Please try again later.',
)
.then((msg) => msg.delete(10000).catch(() => {})); // 🛡️ Sentinel: Avoid leaking RPC error details
} else {
pxc.sendFrom(
tipper,
Expand All @@ -274,7 +286,13 @@ function sendPXC(bot, message, tipper, recipient, amount, privacyFlag) {
null,
function (err, txId) {
if (err) {
message.reply(err.message).then((message) => message.delete(10000));
console.error(err);
// 🛡️ Sentinel: Securely log internal error
message
.reply(
'An error occurred during the transaction. Please try again later.',
)
.then((msg) => msg.delete(10000).catch(() => {})); // 🛡️ Sentinel: Avoid leaking RPC error details
} else {
if (privacyFlag) {
let userProfile = message.guild.members.get(recipient); // ⚡ Bolt: O(1) direct ID lookup vs O(N) linear search;
Expand Down
24 changes: 21 additions & 3 deletions bot/modules/rvnTipper.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,7 +158,13 @@ function doWithdraw(message, tipper, words, helpmsg) {
}
rvn.sendFrom(tipper, address, Number(amount), function (err, txId) {
if (err) {
message.reply(err.message).then((message) => message.delete(10000));
console.error(err);
// 🛡️ Sentinel: Securely log internal error
message
.reply(
'An error occurred during the transaction. Please try again later.',
)
.then((msg) => msg.delete(10000).catch(() => {})); // 🛡️ Sentinel: Avoid leaking RPC error details
} else {
message.channel.send({
embed: {
Expand Down Expand Up @@ -263,7 +269,13 @@ function doTip(bot, message, tipper, words, helpmsg) {
function sendRVN(bot, message, tipper, recipient, amount, privacyFlag) {
getAddress(recipient.toString(), function (err, address) {
if (err) {
message.reply(err.message).then((message) => message.delete(10000));
console.error(err);
// 🛡️ Sentinel: Securely log internal error
message
.reply(
'An error occurred during the transaction. Please try again later.',
)
.then((msg) => msg.delete(10000).catch(() => {})); // 🛡️ Sentinel: Avoid leaking RPC error details
} else {
rvn.sendFrom(
tipper,
Expand All @@ -274,7 +286,13 @@ function sendRVN(bot, message, tipper, recipient, amount, privacyFlag) {
null,
function (err, txId) {
if (err) {
message.reply(err.message).then((message) => message.delete(10000));
console.error(err);
// 🛡️ Sentinel: Securely log internal error
message
.reply(
'An error occurred during the transaction. Please try again later.',
)
.then((msg) => msg.delete(10000).catch(() => {})); // 🛡️ Sentinel: Avoid leaking RPC error details
} else {
if (privacyFlag) {
let userProfile = message.guild.members.get(recipient); // ⚡ Bolt: O(1) direct ID lookup vs O(N) linear search;
Expand Down
24 changes: 21 additions & 3 deletions bot/modules/ufoTipper.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,7 +162,13 @@ function doWithdraw(message, tipper, words, helpmsg) {
}
ufo.sendFrom(tipper, address, Number(amount), function (err, txId) {
if (err) {
message.reply(err.message).then((message) => message.delete(10000));
console.error(err);
// 🛡️ Sentinel: Securely log internal error
message
.reply(
'An error occurred during the transaction. Please try again later.',
)
.then((msg) => msg.delete(10000).catch(() => {})); // 🛡️ Sentinel: Avoid leaking RPC error details
} else {
message.channel.send({
embed: {
Expand Down Expand Up @@ -267,7 +273,13 @@ function doTip(bot, message, tipper, words, helpmsg) {
function sendUFO(bot, message, tipper, recipient, amount, privacyFlag) {
getAddress(recipient.toString(), function (err, address) {
if (err) {
message.reply(err.message).then((message) => message.delete(10000));
console.error(err);
// 🛡️ Sentinel: Securely log internal error
message
.reply(
'An error occurred during the transaction. Please try again later.',
)
.then((msg) => msg.delete(10000).catch(() => {})); // 🛡️ Sentinel: Avoid leaking RPC error details
} else {
ufo.sendFrom(
tipper,
Expand All @@ -278,7 +290,13 @@ function sendUFO(bot, message, tipper, recipient, amount, privacyFlag) {
null,
function (err, txId) {
if (err) {
message.reply(err.message).then((message) => message.delete(10000));
console.error(err);
// 🛡️ Sentinel: Securely log internal error
message
.reply(
'An error occurred during the transaction. Please try again later.',
)
.then((msg) => msg.delete(10000).catch(() => {})); // 🛡️ Sentinel: Avoid leaking RPC error details
} else {
if (privacyFlag) {
let userProfile = message.guild.members.get(recipient); // ⚡ Bolt: O(1) direct ID lookup vs O(N) linear search;
Expand Down
24 changes: 21 additions & 3 deletions bot/modules/vtlTipper.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,7 +158,13 @@ function doWithdraw(message, tipper, words, helpmsg) {
}
vtl.sendFrom(tipper, address, Number(amount), function (err, txId) {
if (err) {
message.reply(err.message).then((message) => message.delete(10000));
console.error(err);
// 🛡️ Sentinel: Securely log internal error
message
.reply(
'An error occurred during the transaction. Please try again later.',
)
.then((msg) => msg.delete(10000).catch(() => {})); // 🛡️ Sentinel: Avoid leaking RPC error details
} else {
message.channel.send({
embed: {
Expand Down Expand Up @@ -263,7 +269,13 @@ function doTip(bot, message, tipper, words, helpmsg) {
function sendVTL(bot, message, tipper, recipient, amount, privacyFlag) {
getAddress(recipient.toString(), function (err, address) {
if (err) {
message.reply(err.message).then((message) => message.delete(10000));
console.error(err);
// 🛡️ Sentinel: Securely log internal error
message
.reply(
'An error occurred during the transaction. Please try again later.',
)
.then((msg) => msg.delete(10000).catch(() => {})); // 🛡️ Sentinel: Avoid leaking RPC error details
} else {
vtl.sendFrom(
tipper,
Expand All @@ -274,7 +286,13 @@ function sendVTL(bot, message, tipper, recipient, amount, privacyFlag) {
null,
function (err, txId) {
if (err) {
message.reply(err.message).then((message) => message.delete(10000));
console.error(err);
// 🛡️ Sentinel: Securely log internal error
message
.reply(
'An error occurred during the transaction. Please try again later.',
)
.then((msg) => msg.delete(10000).catch(() => {})); // 🛡️ Sentinel: Avoid leaking RPC error details
} else {
if (privacyFlag) {
let userProfile = message.guild.members.get(recipient); // ⚡ Bolt: O(1) direct ID lookup vs O(N) linear search;
Expand Down