hyperledger-labs / fabric-smart-client / 29900688672

81%

Build Type

push

github

Committed by web-flow

Commit Message

revert(security): stop redacting responder-view errors sent to remote callers (#1600)

* revert(security): stop redacting responder-view errors sent to remote callers

13c5d99b (#1594) changed Service.respond to send back a generic
"responder failed" string instead of the responder view's actual error,
to avoid leaking internal error/panic detail to a remote peer.

In practice this also erases legitimate business-logic error detail that
callers rely on: a responder view (e.g. an auditor rejecting a transfer
for exceeding a payment limit) returns a business error, not a leak, and
callers across the wire need that text to make decisions and to assert
on it in tests. Downstream, this broke Fabric Token SDK / Panurus
integration tests that check for the specific rejection reason returned
by a remote auditor (payment/holding limit messages, "is not valid",
etc.) - see LFDT-Panurus/panurus#1969.

Revert to sending back the responder's actual err.Error(), matching
respond()'s pre-#1594 behavior in this regard. The rest of #1594
(wire-deserialization validation, endorsement verification hardening)
is unaffected and stays in place.

Signed-off-by: Angelo De Caro <adc@zurich.ibm.com>

* docs: clarify that responder-error content is the application's call

Documents the design principle behind the revert in 12ab47c2: the P2P
runner decides that an error is returned to the remote caller, not what
it contains. SendError forwards err.Error() verbatim, and filtering or
redacting sensitive detail is the responder view's responsibility.

Signed-off-by: Angelo De Caro <adc@zurich.ibm.com>

Coverage Stats

2 of 2 new or added lines in 1 file covered. (100.0%)

5 existing lines in 2 files now uncovered.

32103 of 39519 relevant lines covered (81.23%)

3092.91 hits per line