Skip to content

Exception messages leak SQL / $wpdb->last_error to callers (information disclosure) #32

Description

@alexstandiford

Problem

Several exception messages in the WordPress integration (and the shared db/datastore layers) interpolate database internals into the message string:

  • CanQueryWordPressDatabase / QueryStrategy: throw new DatastoreErrorException('... - ' . $wpdb->last_error) and '... query: ' . $query — raw MySQL error text and assembled SQL.
  • RecordNotFoundException('No records found for query: ' . $query) (and No value/No record siblings).

When such an exception is uncaught it can reach output (PHP fatal with display_errors/WP_DEBUG_DISPLAY), and when caught into a REST error response the SQL/DB error lands in the JSON message field. Either way this is information disclosure — it leaks query structure and DB error detail to the client. (It is also what triggers WordPress's WordPress.Security.EscapeOutput.ExceptionNotEscaped sniff in consumers, though HTML-escaping is the wrong remedy for a JSON/log sink.)

Desired outcome

Exception messages should not carry SQL strings or $wpdb->last_error to the caller. Log the query/DB error at the point of failure (via the framework logger) and throw a stable, non-leaking message. Internal identifiers (class/param/field names) in other messages are fine.

Notes

Surfaced by the Siren WordPress plugin during WordPress.org review-simulation.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions