tRPC Error Information Disclosure

Description

Exposing raw errors, stack traces, or database details to clients aids attackers in reconnaissance and exploitation.

What Shoulder detects

Error handling exposes implementation details. Use error formatter to sanitize errors in production.

How to fix

Use errorFormatter to sanitize errors in production.

```typescript
export const t = initTRPC.context<Context>().create({
  errorFormatter({ shape }) {
    return {
      ...shape,
      data: {
        ...shape.data,
        stack: process.env.NODE_ENV === 'production' ? undefined : shape.data.stack
      }
    };
  }
});
```

Learn more: https://shoulder.dev/learn/typescript/cwe-209/error-information-leak

Applies to

Languages

🟨 JavaScript 🔷 TypeScript

Frameworks

trpc

References

Documentation ↗ OWASP ↗ Learn about CWE-209

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=trpc-error-information-leak .