Skip to content

🛡️ Sentinel: [MEDIUM] Fix Error Stack Trace Leakage #81

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
DerUntote wants to merge 1 commit into
base: master
Choose a base branch
from
Open

🛡️ Sentinel: [MEDIUM] Fix Error Stack Trace Leakage #81

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .jules/sentinel.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
## 2026-06-29 - Error Stack Trace Leakage
**Vulnerability:** The discord bot logs unhandled exceptions and command failures to a dedicated Discord moderation channel. If `config.debug` is enabled, it appended the full error stack trace (`e.stack`) to the discord message.
**Learning:** Sending stack traces to public or even moderation channels can expose sensitive information about the internal architecture and server file paths, which malicious users could potentially exploit. Internal errors should only be logged internally.
**Prevention:** Avoid sending detailed error messages or stack traces externally. Use `console.error` for stack traces instead of appending them to strings sent to external platforms.
124 changes: 61 additions & 63 deletions bot/bot.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,25 +12,27 @@ config = config.get('bot');
var aliases;
// check if any aliases are defined
try {
var time = moment()
.tz('America/Los_Angeles')
.format('MM-DD-YYYY hh:mm a');
var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a');
aliases = require('./alias.json');
console.log('[' + time + ' PST][' + pm2Name + '] ' + Object.keys(aliases).length + ' aliases Loaded!');
console.log(
'[' +
time +
' PST][' +
pm2Name +
'] ' +
Object.keys(aliases).length +
' aliases Loaded!',
);
} catch (e) {
var time = moment()
.tz('America/Los_Angeles')
.format('MM-DD-YYYY hh:mm a');
var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a');
console.log('[' + time + ' PST][' + pm2Name + '] No aliases defined');
}
var commands = {};

var bot = new Discord.Client();

bot.on('ready', function() {
var time = moment()
.tz('America/Los_Angeles')
.format('MM-DD-YYYY hh:mm a');
bot.on('ready', function () {
var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a');
console.log(
'[' +
time +
Expand All @@ -40,21 +42,19 @@ bot.on('ready', function() {
bot.user.username +
'Logged in! Serving in ' +
bot.guilds.size + // ⚡ Bolt: O(1) property lookup vs O(N) array creation
' servers'
' servers',
);
bot.channels.get(logChannel).send(
'[' +
time +
' PST][' +
pm2Name +
'] ' +
bot.user.username +
'Logged in! Serving in ' +
bot.guilds.size + // ⚡ Bolt: O(1) property lookup vs O(N) array creation
' servers',
);
bot.channels
.get(logChannel)
.send(
'[' +
time +
' PST][' +
pm2Name +
'] ' +
bot.user.username +
'Logged in! Serving in ' +
bot.guilds.size + // ⚡ Bolt: O(1) property lookup vs O(N) array creation
' servers'
);
require('./plugins.js').init();
console.log(
'[' +
Expand All @@ -63,7 +63,7 @@ bot.on('ready', function() {
pm2Name +
'] type ' +
config.prefix +
'tiphelp in Discord for a commands list.'
'tiphelp in Discord for a commands list.',
);
bot.channels
.get(logChannel)
Expand All @@ -74,10 +74,19 @@ bot.on('ready', function() {
pm2Name +
'] type ' +
config.prefix +
'tiphelp in Discord for a commands list.'
'tiphelp in Discord for a commands list.',
);
bot.user.setActivity(config.prefix + 'Intialized!');
var text = ['tiprvn', 'tipdoge', 'tiplbc', 'tipufo', 'tipproton', 'tippxc', 'tipftc', 'tiphelp'];
var text = [
'tiprvn',
'tipdoge',
'tiplbc',
'tipufo',
'tipproton',
'tippxc',
'tipftc',
'tiphelp',
];
var counter = 0;
setInterval(change, 10000);

Expand All @@ -90,40 +99,32 @@ bot.on('ready', function() {
}
});

process.on('uncaughtException', err => {
var time = moment()
.tz('America/Los_Angeles')
.format('MM-DD-YYYY hh:mm a');
process.on('uncaughtException', (err) => {
var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a');
console.log('[' + time + ' PST][' + pm2Name + '] uncaughtException: ' + err);
bot.channels
.get(logChannel)
.send('[' + time + ' PST][' + pm2Name + '] uncaughtException: ' + err);
process.exit(1); //exit node.js with an error
});

process.on('unhandledRejection', err => {
var time = moment()
.tz('America/Los_Angeles')
.format('MM-DD-YYYY hh:mm a');
process.on('unhandledRejection', (err) => {
var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a');
console.log('[' + time + ' PST][' + pm2Name + '] unhandledRejection: ' + err);
bot.channels
.get(logChannel)
.send('[' + time + ' PST][' + pm2Name + '] unhandledRejection: ' + err);
process.exit(1); //exit node.js with an error
});

bot.on('disconnected', function() {
var time = moment()
.tz('America/Los_Angeles')
.format('MM-DD-YYYY hh:mm a');
bot.on('disconnected', function () {
var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a');
console.log('[' + time + ' PST][' + pm2Name + '] Disconnected!');
process.exit(1); //exit node.js with an error
});

bot.on('error', function(error) {
var time = moment()
.tz('America/Los_Angeles')
.format('MM-DD-YYYY hh:mm a');
bot.on('error', function (error) {
var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a');
console.log('[' + time + ' PST][' + pm2Name + '] error: ' + error);
process.exit(1); //exit node.js with an error
});
Expand All @@ -139,29 +140,29 @@ function checkMessageForCommand(msg, isEdit) {
) {
msg.author
.send('Please set your Discord Presence to Online to talk to the bot!')
.catch(function(error) {
.catch(function (error) {
msg.channel
.send(
msg.author +
', Please enable Direct Messages from server members to communicate fully with our bot, it is located in the user setting area under Privacy & Safety tab, select the option allow direct messages from server members'
', Please enable Direct Messages from server members to communicate fully with our bot, it is located in the user setting area under Privacy & Safety tab, select the option allow direct messages from server members',
)
.then(
msg.channel.send(
'Please set your Discord Presence to Online to talk to the Bot!'
)
'Please set your Discord Presence to Online to talk to the Bot!',
),
);
return;
});
}
var cmdTxt = msg.content.split(' ')[0].substring(config.prefix.length);
var suffix = msg.content.substring(
cmdTxt.length + config.prefix.length + 1
cmdTxt.length + config.prefix.length + 1,
); //add one for the ! and one for the space
if (msg.isMentioned(bot.user)) {
try {
cmdTxt = msg.content.split(' ')[1];
suffix = msg.content.substring(
bot.user.mention().length + cmdTxt.length + config.prefix.length + 1
bot.user.mention().length + cmdTxt.length + config.prefix.length + 1,
);
} catch (e) {
//no command
Expand All @@ -182,15 +183,16 @@ function checkMessageForCommand(msg, isEdit) {
msg.content +
' from ' +
msg.author.username +
' as command'
' as command',
);
try {
cmd.process(bot, msg, suffix, isEdit);
} catch (e) {
var msgTxt = 'command ' + cmdTxt + ' failed :(';
var linebreak = '\n-------------------------------------------------\n';
if (config.debug) {
msgTxt += '\n' + e.stack;
// 🛡️ Sentinel: Log stack trace internally to avoid leaking file paths to Discord
console.error(e.stack);
}
var time = moment()
.tz('America/Los_Angeles')
Expand All @@ -214,37 +216,33 @@ function checkMessageForCommand(msg, isEdit) {
}
}

bot.on('message', msg => checkMessageForCommand(msg, false));
bot.on('message', (msg) => checkMessageForCommand(msg, false));

exports.addCommand = function(commandName, commandObject) {
exports.addCommand = function (commandName, commandObject) {
try {
commands[commandName] = commandObject;
} catch (err) {
var time = moment()
.tz('America/Los_Angeles')
.format('MM-DD-YYYY hh:mm a');
var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a');
console.log('[' + time + ' PST][' + pm2Name + '] Error addCommand: ' + err);
bot.channels
.get(logChannel)
.send('[' + time + ' PST][' + pm2Name + '] Error addCommand: ' + err);
}
};
exports.addCustomFunc = function(customFunc) {
exports.addCustomFunc = function (customFunc) {
try {
customFunc(bot);
} catch (err) {
var time = moment()
.tz('America/Los_Angeles')
.format('MM-DD-YYYY hh:mm a');
var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a');
console.log(
'[' + time + ' PST][' + pm2Name + '] Error addCustomFunc: ' + err
'[' + time + ' PST][' + pm2Name + '] Error addCustomFunc: ' + err,
);
bot.channels
.get(logChannel)
.send('[' + time + ' PST][' + pm2Name + '] Error addCustomFunc: ' + err);
}
};
exports.commandCount = function() {
exports.commandCount = function () {
return Object.keys(commands).length;
};

Expand Down