fix: 去掉 err 上附带 req 信息，打印 error 的话可能存在安全内容泄漏 (#94)

sofastack · Mar 18, 2022 · 91760de · 91760de
1 parent 448a6db
commit 91760de
Show file tree

Hide file tree

Showing 2 changed files with 0 additions and 11 deletions.
diff --git a/lib/server/server.js b/lib/server/server.js
@@ -254,7 +254,6 @@ class RpcServer extends Base {
     this._connections.set(key, conn);
     conn.on('request', req => {
       this._handleRequest(req, conn).catch(err => {
-        err.req = req;
         this.emit('error', err);
       });
     });

diff --git a/test/server/server.test.js b/test/server/server.test.js
@@ -91,16 +91,6 @@ describe('test/server.test.js', () => {
     } catch (err) {
       console.log(err);
       assert(err.message.includes('Cannot read property \'split\' of null'));
-      assert(err.req);
-      assert(err.req.packetId === 1);
-      assert.deepEqual(err.req.data, {
-        methodName: 'foo',
-        serverSignature: null,
-        args: [],
-        methodArgSigs: [],
-        requestProps: null,
-        targetAppName: 'test',
-      });
     }
     socket.destroy();
     await server.close();