fix(security): sanitize error messages to prevent leaking internal details

[atul-upadhyay-7]

Fixes #7263

Problem

The sanitizeErrorMessage function in app/api/streak/route.ts only filtered messages containing ZodError/zod/schema patterns. All other error messages from GitHub API failures, internal assertion errors, or unexpected exceptions were returned verbatim to the client in both JSON and SVG error responses.

This could expose:

• Internal authentication state (token rotation status, encrypted vs plaintext token usage)
• Internal infrastructure details (cache server addresses, service names)
• Internal error types and code paths that aid further exploitation

Solution

app/api/streak/route.ts

1. Default to generic messages: sanitizeErrorMessage now returns a generic message for all unrecognized errors instead of passing through the raw message.

2. Whitelist safe validation messages: Preserved specific user-facing messages for known client errors: org validation, multi-user validation, and rate limit quota warnings.

3. Classify before sanitizing: Updated buildErrorResponse to detect error type (not-found, rate-limit, validation) using the raw message before sanitization, ensuring correct HTTP status codes while returning sanitized messages to clients.

app/api/streak/route.test.ts

Updated the test assertion for the multi-user validation error to match the line-wrapped SVG output.

Testing

• All 311 streak tests pass (19 test files)
• All 200 route tests pass
• JSON format returns generic message for internal errors
• SVG format returns sanitized error SVG for all non-validation errors

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

📦 Next.js Bundle Size Report (Gzipped Sizes)

✨ No significant bundle size changes detected.

📊 Summary of Totals

Category	PR Size	Base Size	Difference
Total JS	3883.44 KB	3883.44 KB	0 B
Total CSS	323.09 KB	323.09 KB	0 B

[Aamod007]

Hey! Thanks for fixing the error message sanitization logic in the streak API. Leaking internal GitHub API errors or unhandled assertions is a real security risk, and preserving only intentional user validation messages is exactly what we need.

I'm assigning level:advanced, type:security, and quality:clean.

Great work, approving!

[github-actions]

🎉 Congratulations @atul-upadhyay-7! Your PR has been successfully merged. 🚀

Thank you for contributing to CommitPulse. Your work helps us build a better tool for the community.

⚠️ Important for GSSoC Contributors:
You are strictly advised to join our Discord Server as it is mandatory for all GSSoC participants. All important announcements, point claims, and community discussions happen there.

Keep building! 💻✨