From 3651806136550d97edd3d8bbd161debfe6081737 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Mon, 29 Jun 2026 11:47:28 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[MEDIUM]=20?= =?UTF-8?q?Fix=20Error=20Stack=20Trace=20Leakage?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: DerUntote <8378077+DerUntote@users.noreply.github.com> --- .jules/sentinel.md | 4 ++ bot/bot.js | 124 ++++++++++++++++++++++----------------------- 2 files changed, 65 insertions(+), 63 deletions(-) create mode 100644 .jules/sentinel.md diff --git a/.jules/sentinel.md b/.jules/sentinel.md new file mode 100644 index 0000000..c3b2a41 --- /dev/null +++ b/.jules/sentinel.md @@ -0,0 +1,4 @@ +## 2026-06-29 - Error Stack Trace Leakage +**Vulnerability:** The discord bot logs unhandled exceptions and command failures to a dedicated Discord moderation channel. If `config.debug` is enabled, it appended the full error stack trace (`e.stack`) to the discord message. +**Learning:** Sending stack traces to public or even moderation channels can expose sensitive information about the internal architecture and server file paths, which malicious users could potentially exploit. Internal errors should only be logged internally. +**Prevention:** Avoid sending detailed error messages or stack traces externally. Use `console.error` for stack traces instead of appending them to strings sent to external platforms. diff --git a/bot/bot.js b/bot/bot.js index da72836..950d46c 100644 --- a/bot/bot.js +++ b/bot/bot.js @@ -12,25 +12,27 @@ config = config.get('bot'); var aliases; // check if any aliases are defined try { - var time = moment() - .tz('America/Los_Angeles') - .format('MM-DD-YYYY hh:mm a'); + var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a'); aliases = require('./alias.json'); - console.log('[' + time + ' PST][' + pm2Name + '] ' + Object.keys(aliases).length + ' aliases Loaded!'); + console.log( + '[' + + time + + ' PST][' + + pm2Name + + '] ' + + Object.keys(aliases).length + + ' aliases Loaded!', + ); } catch (e) { - var time = moment() - .tz('America/Los_Angeles') - .format('MM-DD-YYYY hh:mm a'); + var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a'); console.log('[' + time + ' PST][' + pm2Name + '] No aliases defined'); } var commands = {}; var bot = new Discord.Client(); -bot.on('ready', function() { - var time = moment() - .tz('America/Los_Angeles') - .format('MM-DD-YYYY hh:mm a'); +bot.on('ready', function () { + var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a'); console.log( '[' + time + @@ -40,21 +42,19 @@ bot.on('ready', function() { bot.user.username + 'Logged in! Serving in ' + bot.guilds.size + // ⚡ Bolt: O(1) property lookup vs O(N) array creation - ' servers' + ' servers', + ); + bot.channels.get(logChannel).send( + '[' + + time + + ' PST][' + + pm2Name + + '] ' + + bot.user.username + + 'Logged in! Serving in ' + + bot.guilds.size + // ⚡ Bolt: O(1) property lookup vs O(N) array creation + ' servers', ); - bot.channels - .get(logChannel) - .send( - '[' + - time + - ' PST][' + - pm2Name + - '] ' + - bot.user.username + - 'Logged in! Serving in ' + - bot.guilds.size + // ⚡ Bolt: O(1) property lookup vs O(N) array creation - ' servers' - ); require('./plugins.js').init(); console.log( '[' + @@ -63,7 +63,7 @@ bot.on('ready', function() { pm2Name + '] type ' + config.prefix + - 'tiphelp in Discord for a commands list.' + 'tiphelp in Discord for a commands list.', ); bot.channels .get(logChannel) @@ -74,10 +74,19 @@ bot.on('ready', function() { pm2Name + '] type ' + config.prefix + - 'tiphelp in Discord for a commands list.' + 'tiphelp in Discord for a commands list.', ); bot.user.setActivity(config.prefix + 'Intialized!'); - var text = ['tiprvn', 'tipdoge', 'tiplbc', 'tipufo', 'tipproton', 'tippxc', 'tipftc', 'tiphelp']; + var text = [ + 'tiprvn', + 'tipdoge', + 'tiplbc', + 'tipufo', + 'tipproton', + 'tippxc', + 'tipftc', + 'tiphelp', + ]; var counter = 0; setInterval(change, 10000); @@ -90,10 +99,8 @@ bot.on('ready', function() { } }); -process.on('uncaughtException', err => { - var time = moment() - .tz('America/Los_Angeles') - .format('MM-DD-YYYY hh:mm a'); +process.on('uncaughtException', (err) => { + var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a'); console.log('[' + time + ' PST][' + pm2Name + '] uncaughtException: ' + err); bot.channels .get(logChannel) @@ -101,10 +108,8 @@ process.on('uncaughtException', err => { process.exit(1); //exit node.js with an error }); -process.on('unhandledRejection', err => { - var time = moment() - .tz('America/Los_Angeles') - .format('MM-DD-YYYY hh:mm a'); +process.on('unhandledRejection', (err) => { + var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a'); console.log('[' + time + ' PST][' + pm2Name + '] unhandledRejection: ' + err); bot.channels .get(logChannel) @@ -112,18 +117,14 @@ process.on('unhandledRejection', err => { process.exit(1); //exit node.js with an error }); -bot.on('disconnected', function() { - var time = moment() - .tz('America/Los_Angeles') - .format('MM-DD-YYYY hh:mm a'); +bot.on('disconnected', function () { + var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a'); console.log('[' + time + ' PST][' + pm2Name + '] Disconnected!'); process.exit(1); //exit node.js with an error }); -bot.on('error', function(error) { - var time = moment() - .tz('America/Los_Angeles') - .format('MM-DD-YYYY hh:mm a'); +bot.on('error', function (error) { + var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a'); console.log('[' + time + ' PST][' + pm2Name + '] error: ' + error); process.exit(1); //exit node.js with an error }); @@ -139,29 +140,29 @@ function checkMessageForCommand(msg, isEdit) { ) { msg.author .send('Please set your Discord Presence to Online to talk to the bot!') - .catch(function(error) { + .catch(function (error) { msg.channel .send( msg.author + - ', Please enable Direct Messages from server members to communicate fully with our bot, it is located in the user setting area under Privacy & Safety tab, select the option allow direct messages from server members' + ', Please enable Direct Messages from server members to communicate fully with our bot, it is located in the user setting area under Privacy & Safety tab, select the option allow direct messages from server members', ) .then( msg.channel.send( - 'Please set your Discord Presence to Online to talk to the Bot!' - ) + 'Please set your Discord Presence to Online to talk to the Bot!', + ), ); return; }); } var cmdTxt = msg.content.split(' ')[0].substring(config.prefix.length); var suffix = msg.content.substring( - cmdTxt.length + config.prefix.length + 1 + cmdTxt.length + config.prefix.length + 1, ); //add one for the ! and one for the space if (msg.isMentioned(bot.user)) { try { cmdTxt = msg.content.split(' ')[1]; suffix = msg.content.substring( - bot.user.mention().length + cmdTxt.length + config.prefix.length + 1 + bot.user.mention().length + cmdTxt.length + config.prefix.length + 1, ); } catch (e) { //no command @@ -182,7 +183,7 @@ function checkMessageForCommand(msg, isEdit) { msg.content + ' from ' + msg.author.username + - ' as command' + ' as command', ); try { cmd.process(bot, msg, suffix, isEdit); @@ -190,7 +191,8 @@ function checkMessageForCommand(msg, isEdit) { var msgTxt = 'command ' + cmdTxt + ' failed :('; var linebreak = '\n-------------------------------------------------\n'; if (config.debug) { - msgTxt += '\n' + e.stack; + // 🛡️ Sentinel: Log stack trace internally to avoid leaking file paths to Discord + console.error(e.stack); } var time = moment() .tz('America/Los_Angeles') @@ -214,37 +216,33 @@ function checkMessageForCommand(msg, isEdit) { } } -bot.on('message', msg => checkMessageForCommand(msg, false)); +bot.on('message', (msg) => checkMessageForCommand(msg, false)); -exports.addCommand = function(commandName, commandObject) { +exports.addCommand = function (commandName, commandObject) { try { commands[commandName] = commandObject; } catch (err) { - var time = moment() - .tz('America/Los_Angeles') - .format('MM-DD-YYYY hh:mm a'); + var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a'); console.log('[' + time + ' PST][' + pm2Name + '] Error addCommand: ' + err); bot.channels .get(logChannel) .send('[' + time + ' PST][' + pm2Name + '] Error addCommand: ' + err); } }; -exports.addCustomFunc = function(customFunc) { +exports.addCustomFunc = function (customFunc) { try { customFunc(bot); } catch (err) { - var time = moment() - .tz('America/Los_Angeles') - .format('MM-DD-YYYY hh:mm a'); + var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a'); console.log( - '[' + time + ' PST][' + pm2Name + '] Error addCustomFunc: ' + err + '[' + time + ' PST][' + pm2Name + '] Error addCustomFunc: ' + err, ); bot.channels .get(logChannel) .send('[' + time + ' PST][' + pm2Name + '] Error addCustomFunc: ' + err); } }; -exports.commandCount = function() { +exports.commandCount = function () { return Object.keys(commands).length; };