UI5 / cli / 41125766447

94%

push

github

fix(server): Redact home directory paths from dev-server error responses

The error handler rendered err.message and err.stack verbatim into the
HTML and plain-text 500 responses, so absolute stack-frame paths exposed
the OS username to any HTTP caller.

Redact home-directory prefixes to ~ before rendering, in both response
formats. The current user's home, the /Users, /home and /root shapes, and
Windows C:\Users\<name>\ are covered, so redaction holds regardless of the
host OS. File names, directories below the home, and line and column
positions stay readable. When the home lookup fails, the handler returns a
safe placeholder rather than raw text.

Non-home paths such as /opt and /var, and resource URLs like /resources/...,
stay intact: they carry no username, and on POSIX a filesystem path and a
URL path are indistinguishable, so redacting them would drop references
developers need.

7899 of 8698 branches covered (90.81%)

Branch coverage included in aggregate %.

10 of 10 new or added lines in 2 files covered. (100.0%)

15012 of 15620 relevant lines covered (96.11%)

5220.97 hits per line