fix(security): prevent debug error pages on staging/production
Root cause: ExceptionHandlingInitializer attempted to autowire EnvironmentType directly, but it was never registered in the DI container. This caused the debug mode resolution to fail silently. Changes: - Use TypedConfiguration instead of EnvironmentType for proper DI - Create ErrorHandlingConfig value object to centralize config - Access debug mode via AppConfig.isDebugEnabled() which respects both APP_DEBUG env var AND EnvironmentType.isDebugEnabled() - Register ErrorHandlingConfig as singleton in container - Remove diagnostic logging from ResponseErrorRenderer This ensures that staging/production environments (where EnvironmentType != DEV) will not display stack traces, code context, or file paths in error responses.
This commit is contained in:
@@ -278,9 +278,6 @@ final readonly class ResponseErrorRenderer implements ErrorRenderer
|
||||
);
|
||||
|
||||
$debugInfo = '';
|
||||
// SECURITY FIX: Only show debug info in development mode
|
||||
// Log to error_log for diagnostic purposes (can be removed after verification)
|
||||
error_log("[ResponseErrorRenderer] isDebugMode={$this->isDebugMode}, APP_ENV=" . ($_ENV['APP_ENV'] ?? 'unknown'));
|
||||
if ($this->isDebugMode) {
|
||||
$debugInfo = $this->generateDebugSection($exception, $contextProvider);
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user