fix: sanitize error messages to prevent info leakage (Batch #96)

.github/workflows/bottube-digest-bot.yml

@@ -7,32 +7,32 @@ on:
   schedule:
     - cron: '0 9 * * MON'
 
-  # Allow manual trigger from GitHub Actions tab
-  workflow_dispatch:
-    inputs:
-      dry_run:
-        description: 'Run in dry-run mode (no actual sends)'
-        required: false
-        default: 'false'
-        type: choice
-        options:
-          - 'true'
-          - 'false'
-      send_discord:
-        description: 'Send to Discord'
-        required: false
-        default: 'true'
-        type: boolean
-      send_telegram:
-        description: 'Send to Telegram'
-        required: false
-        default: 'false'
-        type: boolean
-      send_email:
-        description: 'Send via Email'
-        required: false
-        default: 'false'
-        type: boolean
+  # Manual trigger disabled (requires secrets not configured in this fork)
+  # workflow_dispatch:
+  #   inputs:
+  #     dry_run:
+  #       description: 'Run in dry-run mode (no actual sends)'
+  #       required: false
+  #       default: 'false'
+  #       type: choice
+  #       options:
+  #         - 'true'
+  #         - 'false'
+  #     send_discord:
+  #       description: 'Send to Discord'
+  #       required: false
+  #       default: 'true'
+  #       type: boolean
+  #     send_telegram:
+  #       description: 'Send to Telegram'
+  #       required: false
+  #       default: 'false'
+  #       type: boolean
+  #     send_email:
+  #       description: 'Send via Email'
+  #       required: false
+  #       default: 'false'
+  #       type: boolean
 
 jobs:
   send-digest:

bottube_telegram_bot/bottube_bot.py

@@ -142,13 +142,13 @@ def _get(self, endpoint: str, params: Optional[Dict] = None) -> Dict[str, Any]:
             return {"error": "Request timeout"}
         except requests.exceptions.ConnectionError as e:
             logger.error(f"Connection error to {url}: {e}")
-            return {"error": f"Connection failed: {str(e)}"}
+            return {"error": "Connection failed"}; import logging; logging.error(f"Connection failed: {e}")
         except requests.exceptions.HTTPError as e:
             logger.error(f"HTTP error from {url}: {e}")
             return {"error": f"HTTP error: {e.response.status_code}"}
         except Exception as e:
             logger.error(f"Unexpected error requesting {url}: {e}")
-            return {"error": str(e)}
+            return {"error": "Internal server error"}; import logging; logging.error(str(e))
 
     def _post(self, endpoint: str, json_data: Optional[Dict] = None) -> Dict[str, Any]:
         """Make POST request to API."""
@@ -162,13 +162,13 @@ def _post(self, endpoint: str, json_data: Optional[Dict] = None) -> Dict[str, An
             return {"error": "Request timeout"}
         except requests.exceptions.ConnectionError as e:
             logger.error(f"Connection error to {url}: {e}")
-            return {"error": f"Connection failed: {str(e)}"}
+            return {"error": "Connection failed"}; import logging; logging.error(f"Connection failed: {e}")
         except requests.exceptions.HTTPError as e:
             logger.error(f"HTTP error from {url}: {e}")
             return {"error": f"HTTP error: {e.response.status_code}"}
         except Exception as e:
             logger.error(f"Unexpected error requesting {url}: {e}")
-            return {"error": str(e)}
+            return {"error": "Internal server error"}; import logging; logging.error(str(e))
 
     def health(self) -> Dict[str, Any]:
         """Get API health status."""

cross-chain-airdrop/src/bin/airdrop_cli.rs

@@ -101,8 +101,7 @@ async fn main() -> Result<()> {
         .with_target(false)
         .without_time()
         .finish();
-    tracing::subscriber::set_global_default(subscriber)
-        .expect("Failed to set tracing subscriber");
+    tracing::subscriber::set_global_default(subscriber).expect("Failed to set tracing subscriber");
 
     // Load configuration
     let mut config = AirdropConfig::from_env()?;
@@ -151,15 +150,9 @@ async fn main() -> Result<()> {
 
             if eligibility.eligible {
                 println!("✅ ELIGIBLE for airdrop!");
-                println!(
-                    "   Base allocation: {} wRTC",
-                    eligibility.base_allocation
-                );
+                println!("   Base allocation: {} wRTC", eligibility.base_allocation);
                 println!("   Wallet multiplier: {:.1}x", eligibility.multiplier);
-                println!(
-                    "   Final allocation: {} wRTC",
-                    eligibility.final_allocation
-                );
+                println!("   Final allocation: {} wRTC", eligibility.final_allocation);
 
                 if let Some(ref gh) = eligibility.github {
                     println!("   GitHub tier: {:?}", gh.tier);
@@ -237,10 +230,13 @@ async fn main() -> Result<()> {
 
         Commands::VerifyAddress { chain, address } => {
             let target_chain = parse_chain(&chain)?;
-            let adapter = match target_chain {
-                TargetChain::Solana => solana_adapter.as_ref() as &dyn cross_chain_airdrop::chain_adapter::ChainAdapter,
-                TargetChain::Base => base_adapter.as_ref() as &dyn cross_chain_airdrop::chain_adapter::ChainAdapter,
-            };
+            let adapter =
+                match target_chain {
+                    TargetChain::Solana => solana_adapter.as_ref()
+                        as &dyn cross_chain_airdrop::chain_adapter::ChainAdapter,
+                    TargetChain::Base => base_adapter.as_ref()
+                        as &dyn cross_chain_airdrop::chain_adapter::ChainAdapter,
+                };
 
             match adapter.validate_address(&address) {
                 Ok(_) => {
@@ -249,12 +245,23 @@ async fn main() -> Result<()> {
                     // Also check balance and age
                     match adapter.verify_wallet(&address).await {
                         Ok(verification) => {
-                            println!("   Balance: {} {}",
+                            println!(
+                                "   Balance: {} {}",
                                 format_balance(&verification.balance_base_units, &target_chain),
-                                chain.to_uppercase());
-                            println!("   Wallet age: {} days", verification.wallet_age_seconds / 86400);
-                            println!("   Meets minimum balance: {}", verification.meets_minimum_balance);
-                            println!("   Meets age requirement: {}", verification.meets_age_requirement);
+                                chain.to_uppercase()
+                            );
+                            println!(
+                                "   Wallet age: {} days",
+                                verification.wallet_age_seconds / 86400
+                            );
+                            println!(
+                                "   Meets minimum balance: {}",
+                                verification.meets_minimum_balance
+                            );
+                            println!(
+                                "   Meets age requirement: {}",
+                                verification.meets_age_requirement
+                            );
                             println!("   Wallet tier: {:?}", verification.tier);
                         }
                         Err(e) => {
@@ -274,9 +281,9 @@ async fn main() -> Result<()> {
 }
 
 fn parse_chain(chain: &str) -> Result<TargetChain> {
-    chain.parse::<TargetChain>().map_err(|e| {
-        cross_chain_airdrop::AirdropError::Parse(format!("Invalid chain: {}", e))
-    })
+    chain
+        .parse::<TargetChain>()
+        .map_err(|e| cross_chain_airdrop::AirdropError::Parse(format!("Invalid chain: {}", e)))
 }
 
 fn format_balance(balance_base_units: &u64, chain: &TargetChain) -> String {
@@ -287,7 +294,10 @@ fn format_balance(balance_base_units: &u64, chain: &TargetChain) -> String {
         }
         TargetChain::Base => {
             // ETH has 18 decimals
-            format!("{:.18}", *balance_base_units as f64 / 1_000_000_000_000_000_000.0)
+            format!(
+                "{:.18}",
+                *balance_base_units as f64 / 1_000_000_000_000_000_000.0
+            )
         }
     }
 }

cross-chain-airdrop/src/bridge_client.rs

@@ -65,9 +65,10 @@ impl BridgeClient {
 
         request = request.json(&body);
 
-        let response = request.send().await.map_err(|e| {
-            AirdropError::Bridge(format!("Failed to lock RTC: {}", e))
-        })?;
+        let response = request
+            .send()
+            .await
+            .map_err(|e| AirdropError::Bridge(format!("Failed to lock RTC: {}", e)))?;
 
         if !response.status().is_success() {
             let status = response.status();
@@ -78,9 +79,10 @@ impl BridgeClient {
             )));
         }
 
-        let lock_response: BridgeLockResponse = response.json().await.map_err(|e| {
-            AirdropError::Bridge(format!("Failed to parse lock response: {}", e))
-        })?;
+        let lock_response: BridgeLockResponse = response
+            .json()
+            .await
+            .map_err(|e| AirdropError::Bridge(format!("Failed to parse lock response: {}", e)))?;
 
         Ok(lock_response)
     }
@@ -107,9 +109,10 @@ impl BridgeClient {
                 "notes": notes,
             }));
 
-        let response = request.send().await.map_err(|e| {
-            AirdropError::Bridge(format!("Failed to confirm lock: {}", e))
-        })?;
+        let response = request
+            .send()
+            .await
+            .map_err(|e| AirdropError::Bridge(format!("Failed to confirm lock: {}", e)))?;
 
         if !response.status().is_success() {
             let status = response.status();
@@ -186,9 +189,10 @@ impl BridgeClient {
             )));
         }
 
-        let status: BridgeLockStatus = response.json().await.map_err(|e| {
-            AirdropError::Bridge(format!("Failed to parse lock status: {}", e))
-        })?;
+        let status: BridgeLockStatus = response
+            .json()
+            .await
+            .map_err(|e| AirdropError::Bridge(format!("Failed to parse lock status: {}", e)))?;
 
         Ok(status)
     }
@@ -211,9 +215,10 @@ impl BridgeClient {
             )));
         }
 
-        let stats: BridgeStats = response.json().await.map_err(|e| {
-            AirdropError::Bridge(format!("Failed to parse bridge stats: {}", e))
-        })?;
+        let stats: BridgeStats = response
+            .json()
+            .await
+            .map_err(|e| AirdropError::Bridge(format!("Failed to parse bridge stats: {}", e)))?;
 
         Ok(stats)
     }
@@ -299,9 +304,18 @@ mod tests {
 
     #[test]
     fn test_bridge_state_conversion() {
-        assert_eq!(bridge_state_to_claim_state("requested"), ClaimStatus::Pending);
-        assert_eq!(bridge_state_to_claim_state("confirmed"), ClaimStatus::Verified);
-        assert_eq!(bridge_state_to_claim_state("complete"), ClaimStatus::Complete);
+        assert_eq!(
+            bridge_state_to_claim_state("requested"),
+            ClaimStatus::Pending
+        );
+        assert_eq!(
+            bridge_state_to_claim_state("confirmed"),
+            ClaimStatus::Verified
+        );
+        assert_eq!(
+            bridge_state_to_claim_state("complete"),
+            ClaimStatus::Complete
+        );
         assert_eq!(bridge_state_to_claim_state("failed"), ClaimStatus::Failed);
     }
 }