[BE-114] AllExceptionsFilter leaks internal exception messages on 500 responses

[yusuftomilola]

Overview

AllExceptionsFilter.catch() (backend/src/common/filters/all-exceptions.filter.ts) falls through to message = exception.message for any non-HttpException error, then returns it in the JSON response body. A raw driver error (a Postgres constraint message, an unexpected null-reference stack trimmed to its first line, etc.) is sent straight to the API client. The only existing test for this filter, in backend/src/mxllv-common.spec.ts, is expect(filter).toBeDefined() — it never exercises the actual catch() behavior, so this was never caught.

Tasks

• For non-HttpException errors, return a fixed generic message (e.g. 'Internal server error') in the response body while still logging the real exception.message/stack via the existing Logger.error() call.
• Add real tests: assert an HttpException still surfaces its own message/status, and a generic Error thrown from a service surfaces only the generic message with a 500 status.
• Audit for any place that intentionally relies on the current leaking behavior before changing it.

Acceptance Criteria

• A thrown non-HTTP Error never puts exception.message in the HTTP response body.
• HttpException responses are unchanged.
• New tests cover both branches of catch().

Notes for Contributors

Comment below to be assigned.

[Imole203]

@Imole203 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

I will love to work on this issue,pls 🙏 assign this to me

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Imole203 to this issue.

[faruke24]

@faruke24 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

I would like to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @faruke24 to this issue.

[Praxhant97]

@Praxhant97 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

#1256 [BE-114] AllExceptionsFilter leaks internal exception messages on 500 responses
Repo Avatar
DistinctCodes/AssetsUp
Overview
AllExceptionsFilter.catch() (backend/src/common/filters/all-exceptions.filter.ts) falls through to message = exception.message for any non-HttpException error, then returns it in the JSON response body. A raw driver error (a Postgres constraint message, an unexpected null-reference stack trimmed to its first line, etc.) is sent straight to the API client. The only existing test for this filter, in backend/src/mxllv-common.spec.ts, is expect(filter).toBeDefined() — it never exercises the actual catch() behavior, so this was never caught.

Tasks
For non-HttpException errors, return a fixed generic message (e.g. 'Internal server error') in the response body while still logging the real exception.message/stack via the existing Logger.error() call.
Add real tests: assert an HttpException still surfaces its own message/status, and a generic Error thrown from a service surfaces only the generic message with a 500 status.
Audit for any place that intentionally relies on the current leaking behavior before changing it.
Acceptance Criteria
A thrown non-HTTP Error never puts exception.message in the HTTP response body.
HttpException responses are unchanged.
New tests cover both branches of catch().
Notes for Contributors
Comment below to be assigned.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Praxhant97 to this issue.

[peternnadi1999]

@peternnadi1999 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi, I’d like to work on this issue. I can update AllExceptionsFilter so unexpected non-HttpException errors return a safe generic 500 response while preserving the existing detailed error logging for debugging.

I’ll first audit the codebase for any intentional dependencies on the current exception-message behavior, then update the filter and add meaningful tests covering both branches: preserving the original message/status for HttpException responses and ensuring generic Error instances expose only the generic 500 message. This will prevent internal database and runtime details from leaking to API clients without reducing server-side observability.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @peternnadi1999 to this issue.

[Hassan-oladipupo]

@Hassan-oladipupo has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

I can take this bug on and track down the root cause.

AllExceptionsFilter.catch() (backend/src/common/filters/all-exceptions.filter.ts) falls through to message = exception.message for any non-HttpException error, then returns it in the JSON response body.

I'll make sure each of these is covered:

• A thrown non-HTTP Error never puts exception.message in the HTTP response body
• HttpException responses are unchanged
• New tests cover both branches of catch()
• Notes for Contributors

I'll keep the change focused and match the existing code conventions.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Hassan-oladipupo to this issue.

[drips-wave]

Congratulations, @Hassan-oladipupo! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @Hassan-oladipupo: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox!

@Hassan-oladipupo's PR #1360 was approved and merged by @yusuftomilola.

🏆 @Hassan-oladipupo: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (532 total points). Track your full progress on GrantFox.

👏 Great work, @Hassan-oladipupo! Keep contributing to DistinctCodes.

[drips-wave]

This issue has been completed by @Hassan-oladipupo as part of the Stellar Wave Program's 8th Wave 🥳

😎 @Hassan-oladipupo: You earned 200 Points for completing this issue! After the current Wave ends, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.

🧑‍💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.