Chirag Singhal 237bd59173 fix(api): sanitize catch-block error.message in middleware/hooks routes (#6645) ...

* fix(api): sanitize catch-block error.message in middleware/hooks routes

POST /api/middleware/hooks and PUT /api/middleware/hooks/[name] returned
the raw error?.message in their 500 response bodies (Hard Rule #12),
which could leak internal SQLite error text/paths on a DB failure. Both
now route through sanitizeErrorMessage() from open-sse/utils/error.ts,
matching the pattern already used elsewhere in the codebase.

Regression guard: tests/unit/middleware-hooks-error-sanitization.test.ts

Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

* test(mutation): register middleware-hooks-error-sanitization in stryker tap.testFiles

The mutation test-coverage gate (check:mutation-test-coverage --strict)
flagged tests/unit/middleware-hooks-error-sanitization.test.ts as
covering open-sse/utils/error.ts but missing from stryker.conf.json's
tap.testFiles list.

Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

* fix(changelog): restore CHANGELOG bullets eaten by release sync

Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

* fix(changelog): re-restore CHANGELOG bullet after further release sync

Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

---------

Co-authored-by: Chirag Singhal <chirag127@users.noreply.github.com>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com>

2026-07-09 17:31:52 -03:00

1.4 KiB

Raw Blame History

View Raw