Option to show stack traces on the 500 page

[silverwind]

It'd be useful for debugging to have stack traces available on the 500 page to give an indication on where/why the error occured without having to dig into the logs, maybe in a expandable box. I'd even lean to having that option on by default.

[jolheiser]

I'd even lean to having that option on by default.

Perhaps for admin users? Similar to the report message.

[silverwind]

Yeah, admins should always see it. I guess there could be options:

ui.SHOW_STACK_TRACES = true
ui.SHOW_STACK_TRACES_TO = all | admin

[veita]

Note that showing stack traces with error messages to the client has the potential to weaken the security of web applications, e.g, through CWE-79.

[silverwind]

XSS should of course be avoided with HTML escaping. Other than that, my only concern is a "leakage" of file system paths, but I don't think this would give much of an attack vector of its own.

[veita]

HTML escaping does not help since the server generally does not have control about the context in which the data are processed by the client.

[bryanpedini]

I guess there could be options:

I'm with @veita here, even having an option to show the stack traces to everybody is a potential security flaw, not so much about your instance per se, as much about the application itself in general, leaving more room to malitious users to find a way in (potentially) all instances.

(I know the entire project is open source, but digging into Golang code to find a breach is much harder than having a direct path in shown directly by the server itself you're trying to breach 😉)

EDIT:
I've forgot to mention: there are logs too, and I assume there would be quite good and secure application out there in the wild internet, to let you create users to then distribute to your admins to have realtime read-only access to Gitea's log by symlinking the log to the WWW folder of the webapp for example (or give them a no-permissions Unix account on your server (even chrooted) and symlink the log in their home)

[lafriks]

Stack trace could be shown if Gitea is run in development mode

[bryanpedini]

Stack trace could be shown if Gitea is run in development mode

Couldn't agree more: temp move Gitea to dev -> solve issue -> go back to production

[silverwind]

That would for example not really help developers that want to debug errors seen on try.gitea.io for example, unless we permanently run it on dev mode.

I still think it's kind of pointless trying to hide internals when the whole source code is open source. Paths could potentially be sanitized as well.

[bryanpedini]

unless we permanently run it on dev mode.

I think it is in dev mode... correct me if I'm wrong @lafriks.

I still think it's kind of pointless trying to hide internals when the whole source code is open source.

As said before, it's not so much as the source is open, but rather as it would lead to a "come here, open entrance" message directly from your server... it would be simply just easier to exploit without having to even actually knowing Go

[silverwind]

I'm not sure what dev mode entails but I could see a toggle in the admin settings UI to temporarily switch the run mode. Of course it should be turned off after debugging. We can't really restrict it to logged in admin users because some errors can happen before login.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. I am here to help clear issues left open even if solved or waiting for more insight. This issue will be closed if no further activity occurs during the next 2 weeks. If the issue is still valid just add a comment to keep it alive. Thank you for your contributions.

[6543]

as for api: #13115