From b95fd097677d45ac00f6c850ad1f4342dad25e51 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Wed, 1 Jul 2026 12:07:31 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20Fix=20serve?= =?UTF-8?q?r=20path=20exposure=20in=20error=20logs?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Appended to `.jules/sentinel.md` with learnings about server path exposure in moderation channel logs. Modified `bot/bot.js` to output `e.stack` internally to console instead of appending it to messages sent to the moderation channel via discord.js, preventing potential exposure of the internal structure to users with access to that channel. Co-authored-by: DerUntote <8378077+DerUntote@users.noreply.github.com> --- .jules/sentinel.md | 4 ++ bot/bot.js | 124 ++++++++++++++++++++++----------------------- 2 files changed, 65 insertions(+), 63 deletions(-) create mode 100644 .jules/sentinel.md diff --git a/.jules/sentinel.md b/.jules/sentinel.md new file mode 100644 index 0000000..b8ed373 --- /dev/null +++ b/.jules/sentinel.md @@ -0,0 +1,4 @@ +## 2024-07-01 - Prevent Exposing Server Paths in Discord Logs +**Vulnerability:** Error stack traces were being appended to Discord moderation channel messages when `config.debug` is enabled, exposing server file paths. +**Learning:** Even internal moderation channels shouldn't receive raw stack traces, as they leak server structure. +**Prevention:** Always log stack traces internally via `console.error()` and send only generic error messages to Discord APIs. diff --git a/bot/bot.js b/bot/bot.js index da72836..5760340 100644 --- a/bot/bot.js +++ b/bot/bot.js @@ -12,25 +12,27 @@ config = config.get('bot'); var aliases; // check if any aliases are defined try { - var time = moment() - .tz('America/Los_Angeles') - .format('MM-DD-YYYY hh:mm a'); + var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a'); aliases = require('./alias.json'); - console.log('[' + time + ' PST][' + pm2Name + '] ' + Object.keys(aliases).length + ' aliases Loaded!'); + console.log( + '[' + + time + + ' PST][' + + pm2Name + + '] ' + + Object.keys(aliases).length + + ' aliases Loaded!', + ); } catch (e) { - var time = moment() - .tz('America/Los_Angeles') - .format('MM-DD-YYYY hh:mm a'); + var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a'); console.log('[' + time + ' PST][' + pm2Name + '] No aliases defined'); } var commands = {}; var bot = new Discord.Client(); -bot.on('ready', function() { - var time = moment() - .tz('America/Los_Angeles') - .format('MM-DD-YYYY hh:mm a'); +bot.on('ready', function () { + var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a'); console.log( '[' + time + @@ -40,21 +42,19 @@ bot.on('ready', function() { bot.user.username + 'Logged in! Serving in ' + bot.guilds.size + // ⚡ Bolt: O(1) property lookup vs O(N) array creation - ' servers' + ' servers', + ); + bot.channels.get(logChannel).send( + '[' + + time + + ' PST][' + + pm2Name + + '] ' + + bot.user.username + + 'Logged in! Serving in ' + + bot.guilds.size + // ⚡ Bolt: O(1) property lookup vs O(N) array creation + ' servers', ); - bot.channels - .get(logChannel) - .send( - '[' + - time + - ' PST][' + - pm2Name + - '] ' + - bot.user.username + - 'Logged in! Serving in ' + - bot.guilds.size + // ⚡ Bolt: O(1) property lookup vs O(N) array creation - ' servers' - ); require('./plugins.js').init(); console.log( '[' + @@ -63,7 +63,7 @@ bot.on('ready', function() { pm2Name + '] type ' + config.prefix + - 'tiphelp in Discord for a commands list.' + 'tiphelp in Discord for a commands list.', ); bot.channels .get(logChannel) @@ -74,10 +74,19 @@ bot.on('ready', function() { pm2Name + '] type ' + config.prefix + - 'tiphelp in Discord for a commands list.' + 'tiphelp in Discord for a commands list.', ); bot.user.setActivity(config.prefix + 'Intialized!'); - var text = ['tiprvn', 'tipdoge', 'tiplbc', 'tipufo', 'tipproton', 'tippxc', 'tipftc', 'tiphelp']; + var text = [ + 'tiprvn', + 'tipdoge', + 'tiplbc', + 'tipufo', + 'tipproton', + 'tippxc', + 'tipftc', + 'tiphelp', + ]; var counter = 0; setInterval(change, 10000); @@ -90,10 +99,8 @@ bot.on('ready', function() { } }); -process.on('uncaughtException', err => { - var time = moment() - .tz('America/Los_Angeles') - .format('MM-DD-YYYY hh:mm a'); +process.on('uncaughtException', (err) => { + var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a'); console.log('[' + time + ' PST][' + pm2Name + '] uncaughtException: ' + err); bot.channels .get(logChannel) @@ -101,10 +108,8 @@ process.on('uncaughtException', err => { process.exit(1); //exit node.js with an error }); -process.on('unhandledRejection', err => { - var time = moment() - .tz('America/Los_Angeles') - .format('MM-DD-YYYY hh:mm a'); +process.on('unhandledRejection', (err) => { + var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a'); console.log('[' + time + ' PST][' + pm2Name + '] unhandledRejection: ' + err); bot.channels .get(logChannel) @@ -112,18 +117,14 @@ process.on('unhandledRejection', err => { process.exit(1); //exit node.js with an error }); -bot.on('disconnected', function() { - var time = moment() - .tz('America/Los_Angeles') - .format('MM-DD-YYYY hh:mm a'); +bot.on('disconnected', function () { + var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a'); console.log('[' + time + ' PST][' + pm2Name + '] Disconnected!'); process.exit(1); //exit node.js with an error }); -bot.on('error', function(error) { - var time = moment() - .tz('America/Los_Angeles') - .format('MM-DD-YYYY hh:mm a'); +bot.on('error', function (error) { + var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a'); console.log('[' + time + ' PST][' + pm2Name + '] error: ' + error); process.exit(1); //exit node.js with an error }); @@ -139,29 +140,29 @@ function checkMessageForCommand(msg, isEdit) { ) { msg.author .send('Please set your Discord Presence to Online to talk to the bot!') - .catch(function(error) { + .catch(function (error) { msg.channel .send( msg.author + - ', Please enable Direct Messages from server members to communicate fully with our bot, it is located in the user setting area under Privacy & Safety tab, select the option allow direct messages from server members' + ', Please enable Direct Messages from server members to communicate fully with our bot, it is located in the user setting area under Privacy & Safety tab, select the option allow direct messages from server members', ) .then( msg.channel.send( - 'Please set your Discord Presence to Online to talk to the Bot!' - ) + 'Please set your Discord Presence to Online to talk to the Bot!', + ), ); return; }); } var cmdTxt = msg.content.split(' ')[0].substring(config.prefix.length); var suffix = msg.content.substring( - cmdTxt.length + config.prefix.length + 1 + cmdTxt.length + config.prefix.length + 1, ); //add one for the ! and one for the space if (msg.isMentioned(bot.user)) { try { cmdTxt = msg.content.split(' ')[1]; suffix = msg.content.substring( - bot.user.mention().length + cmdTxt.length + config.prefix.length + 1 + bot.user.mention().length + cmdTxt.length + config.prefix.length + 1, ); } catch (e) { //no command @@ -182,7 +183,7 @@ function checkMessageForCommand(msg, isEdit) { msg.content + ' from ' + msg.author.username + - ' as command' + ' as command', ); try { cmd.process(bot, msg, suffix, isEdit); @@ -190,7 +191,8 @@ function checkMessageForCommand(msg, isEdit) { var msgTxt = 'command ' + cmdTxt + ' failed :('; var linebreak = '\n-------------------------------------------------\n'; if (config.debug) { - msgTxt += '\n' + e.stack; + // 🛡️ Sentinel: Log stack trace internally to avoid exposing server paths in Discord + console.error(e); } var time = moment() .tz('America/Los_Angeles') @@ -214,37 +216,33 @@ function checkMessageForCommand(msg, isEdit) { } } -bot.on('message', msg => checkMessageForCommand(msg, false)); +bot.on('message', (msg) => checkMessageForCommand(msg, false)); -exports.addCommand = function(commandName, commandObject) { +exports.addCommand = function (commandName, commandObject) { try { commands[commandName] = commandObject; } catch (err) { - var time = moment() - .tz('America/Los_Angeles') - .format('MM-DD-YYYY hh:mm a'); + var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a'); console.log('[' + time + ' PST][' + pm2Name + '] Error addCommand: ' + err); bot.channels .get(logChannel) .send('[' + time + ' PST][' + pm2Name + '] Error addCommand: ' + err); } }; -exports.addCustomFunc = function(customFunc) { +exports.addCustomFunc = function (customFunc) { try { customFunc(bot); } catch (err) { - var time = moment() - .tz('America/Los_Angeles') - .format('MM-DD-YYYY hh:mm a'); + var time = moment().tz('America/Los_Angeles').format('MM-DD-YYYY hh:mm a'); console.log( - '[' + time + ' PST][' + pm2Name + '] Error addCustomFunc: ' + err + '[' + time + ' PST][' + pm2Name + '] Error addCustomFunc: ' + err, ); bot.channels .get(logChannel) .send('[' + time + ' PST][' + pm2Name + '] Error addCustomFunc: ' + err); } }; -exports.commandCount = function() { +exports.commandCount = function () { return Object.keys(commands).length; };