Default error_censor regex too narrow; misses token/api_key/auth/credential

Severity: medium · Status: reasoned from code

lib/Dancer2/Core/Error.pm:88:

sensitive_fields => qr/pass|card.?num|pan|secret/i,

This is the only thing standing between a 5xx error page and the full application config. When show_stacktrace is on, environment() (lines 439-456) dumps $self->app->settings, the entire session, and the PSGI env into the HTML error page.

The current pattern misses token, api_key, auth, credential, private_key, dsn, salt, cvv, ssn — most of what a modern application config actually holds.

Suggested fix

sensitive_fields => qr/
    pass | secret | token | auth | credential | api.?key
  | private.?key | salt | dsn | card.?num | pan | cvv | ssn
/xi,

Widening the default costs nothing and is strictly safer. Applications needing the old behaviour can already override via the error_censor setting. Worth a Changes entry since it changes what appears on development error pages.

Also in this file: unescaped $file in the backtrace

Line 397 interpolates $file into HTML unescaped, while every neighbouring line uses _html_encode:

$html .= qq|<div class="title">$file around line $line</div>|;

$file must survive Path::Tiny::path($file)->is_file first, so I could not construct an exploit — an attacker would need to control a filename on disk. But it is inconsistent with its neighbours and should be _html_encode($file). ($line is (\d+) and is fine.)

Checked and cleared — recorded so nobody re-treads it

The uri_base interpolation at line 171:

<link rel="stylesheet" href="[% uri_base %]/css/error.css">

derives from the client-controlled Host / X-Forwarded-Host header and is rendered by Template::Tiny, which does not auto-escape. This looks like reflected XSS on every default error page, including 404s. It is not exploitable — URI's authority() percent-encodes the dangerous characters first:

Host: [a"><script>alert(1)</script>]
  uri_base -> [http://a%22%3E%3Cscript%3Ealert(1)%3C%2Fscript%3E]

Worth knowing that the defence is incidental to URI's behaviour rather than deliberate on our part. If that interpolation is ever refactored to bypass URI, this becomes live.

Start in lib/Dancer2/Core/Error.pm around lines 88, 397, and 439-456, reading how error_censor and the error-page HTML are assembled. Check the existing error handling coverage before updating the default sensitive-field matching and escaping the backtrace filename, then add the requested Changes entry. Done means the listed sensitive names are censored and the filename is safely rendered without changing the documented override behavior.