fix(security): sanitize error disclosure across marketplace apps [ACT-3522]#11057
Open
Tyler (tylerwashington888) wants to merge 10 commits into
Open
fix(security): sanitize error disclosure across marketplace apps [ACT-3522]#11057Tyler (tylerwashington888) wants to merge 10 commits into
Tyler (tylerwashington888) wants to merge 10 commits into
Conversation
…I002-JAVASCRIPT-00027) Replaces raw console.error(error) calls with sanitized messages in four apps to prevent stack trace and error detail exposure (CWE-209). - graphql-playground ConfigScreen: 'Failed to save app configuration.' - bedrock CommonGenerator: 'Failed to generate content.' - ai-content-generator RewriteGenerator: 'Failed to generate content.' - bedrock RewriteGenerator: 'Failed to generate content.' Closes ACT-3525, ACT-3524, ACT-3523, ACT-3522
This was referenced Jul 6, 2026
Closed
Closed
Tyler (tylerwashington888)
changed the title
…-content-generator [ACT-3522] - Restore `instanceof Error ? error.message : String(error)` pattern across all affected files so meaningful error messages are logged without leaking stack traces - Add lavamoat allowScripts config and @lavamoat/allow-scripts devDependency to ai-content-generator so esbuild postinstall runs on CI - Add ai-content-generator to the run_allow_scripts CircleCI loop (was missing; only bedrock was listed) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…r [ACT-3522] Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…losure [ACT-3522] Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
ryunsong-contentful
approved these changes
Jul 6, 2026
…vercel app [ACT-4040] - Replace raw `console.error(error)` with a static message in hide-publish.ts (ACT-4040) - Replace raw `console.error(e)` with a static message in Vercel.ts (ACT-4039) Both fixes address WS-I002-JAVASCRIPT-00027 (sensitive data exposure via error logging). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
ryunsong-contentful
approved these changes
Jul 6, 2026
…l frontend [ACT-3522] Both packages use vite/vitest but were missing the lavamoat allow-scripts setup that bedrock already has, causing @esbuild/linux-x64 to not install on CI due to ignore-scripts=true in root .npmrc. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
… on Linux vite>esbuild postinstall was blocked by ignore-scripts=true in root .npmrc; graphql-playground had no lavamoat config, causing build job to fail on CI. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…at config graphql-playground-react brings in webpack/babel transitive deps with scripts that can't be enumerated without allow-scripts auto on a matching Linux env. Without preinstall-always-fail, allow-scripts run only executes whitelisted scripts (vite>esbuild) and silently skips unlisted ones. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes WS-I002-JAVASCRIPT-00027 (CWE-209 — Disclosure of Error Details and Stack Traces) across four apps by replacing raw
console.error(error)calls with sanitized, context-specific messages.apps/graphql-playground/src/components/ConfigScreen.tsxconsole.error(error)console.error('Failed to save app configuration.')apps/bedrock-content-generator/.../CommonGenerator.tsxconsole.error(error)console.error('Failed to generate content.')apps/ai-content-generator/.../RewriteGenerator.tsxconsole.error(error)console.error('Failed to generate content.')apps/bedrock-content-generator/.../RewriteGenerator.tsxconsole.error(error)console.error('Failed to generate content.')Wiz details
WS-I002-JAVASCRIPT-00027Replaces
Consolidates the following individual PRs (being closed):
🤖 Generated with Claude Code