BetterErrors / better_errors

Better error page for Rack apps
MIT License
6.88k stars 435 forks source link

Validate internal request method names #475

Closed RobinDaugherty closed 3 years ago

RobinDaugherty commented 3 years ago

Internal calls expose exception information which might contain some sensitive information. The method name was taken from the request path and called on the ErrorPage instance without validation, which might have led to an insecure situation if a method was added to the ErrorPage class without us realizing that it would be exposed through internal calls.