COLDBOX-1247 #resolve

Do not expose restful handler exception data unless you are in debug mode
ColdBox · Oct 10, 2023 · d21f027 · d21f027
1 parent 281f179
commit d21f027
Showing 1 changed file with 2 additions and 3 deletions.
diff --git a/system/RestHandler.cfc b/system/RestHandler.cfc
@@ -547,7 +547,6 @@ component extends="EventHandler" {
 			return;
 		}
 
-
 		// Log Exception
 		log.error(
 			"Error calling #arguments.event.getCurrentEvent()#: #arguments.exception.message# #arguments.exception.detail#",
@@ -563,7 +562,7 @@ component extends="EventHandler" {
 		// Setup General Error Response
 		arguments.prc.response
 			.setError( true )
-			.setData( {
+			.setData( inDebugMode() ? {
 				"environment" : {
 					"currentRoute"     : arguments.event.getCurrentRoute(),
 					"currentRoutedUrl" : arguments.event.getCurrentRoutedUrl(),
@@ -576,7 +575,7 @@ component extends="EventHandler" {
 					"detail"       : arguments.exception.detail,
 					"extendedInfo" : arguments.exception.extendedInfo
 				}
-			} )
+			} : {} )
 			.addMessage( "An exception ocurred: #arguments.exception.message#" )
 			.setStatusCode( arguments.event.STATUS.INTERNAL_ERROR )
 			.setStatusText( "General application error" );