release: v6.14.1 — asyncHandler refactor + accidental info-leak fix

Post-Express-5 cleanup promised in v6.14.0 release notes. 175 async
handlers across 21 route files now use a single asyncHandler() wrapper
instead of the duplicated try/catch + res.status(500).json({ error:
err.message }) boilerplate. Net diff: -521 LOC.

Non-obvious security fix discovered in the process:

The central error middleware at src/server.js:168 sanitizes 5xx
responses (scrubs /home/ and /data/ paths, redacts credentials in
URLs, replaces raw err.message with "Internal server error"). But
the try/catch wrappers in 21 route files were BYPASSING that
sanitizer by calling res.status(500).json({ error: err.message })
directly.

After this release all generic 500s go through the sanitizer — no
more accidental path/credential leaks in error messages.

What's left alone (by design): handlers with dynamic status codes,
non-generic catch shapes, 4xx-mapping logic, SSE callbacks, or
business-logic in the catch block. 10 legitimate res.status(500)
call sites remain — all inspected and confirmed non-generic.

Tests: 740 passing / 4 skipped (unchanged).
Lint: zero warnings on src/routes/.

Author: bogdanpricop

CHANGELOG.md

@@ -2,6 +2,75 @@
 
 All notable changes to Docker Dash are documented here.
 
+## [6.14.1] - 2026-04-22 — "asyncHandler refactor (+ accidental info-leak fix)"
+
+Post-v6.14.0 cleanup promised in the previous release notes: consolidate the try/catch + `res.status(500).json({ error: err.message })` boilerplate into a single `asyncHandler(fn)` wrapper. 175 handlers migrated across 21 route files. **Net diff: −521 LOC.**
+
+### What this actually fixes (the non-obvious win)
+
+Docker Dash's central error middleware at [src/server.js:168-190](src/server.js#L168-L190) already **sanitizes** 5xx responses — scrubs home/data paths, redacts URL credentials, and replaces the raw `err.message` with `'Internal server error'`. Until now, the try/catch wrappers in 21 route files **bypassed** that sanitization by calling `res.status(500).json({ error: err.message })` directly. So any backend error surfacing through those handlers was leaking the raw exception string to the client.
+
+After this release, all generic 500 responses go through the central middleware → **no more accidental path or credential exposure in error messages.**
+
+This wasn't the stated goal of the refactor (the goal was LOC reduction), but it's the more important outcome. Worth calling out for anyone reading the CHANGELOG looking for security-relevant deltas.
+
+### Added — `src/utils/asyncHandler.js`
+
+Four lines of utility:
+```js
+function asyncHandler(fn) {
+  return (req, res, next) => Promise.resolve(fn(req, res, next)).catch(next);
+}
+```
+
+Rejected promises now auto-forward to the Express 5 error middleware chain (where the existing sanitizer at line 168 takes over).
+
+### Changed — 21 route files refactored (175 handler invocations)
+
+Sample before/after from [src/routes/containers.js](src/routes/containers.js):
+
+```js
+// Before
+router.get('/:id/inspect', requireAuth, async (req, res) => {
+  try {
+    const data = await dockerService.inspectContainer(req.params.id, req.hostId);
+    res.json(data);
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
+// After
+router.get('/:id/inspect', requireAuth, asyncHandler(async (req, res) => {
+  const data = await dockerService.inspectContainer(req.params.id, req.hostId);
+  res.json(data);
+}));
+```
+
+### What was deliberately NOT unwrapped
+
+Per the refactor brief, handlers with any of the following keep their try/catch blocks:
+- Dynamic status codes (e.g. `err.statusCode === 404 ? 404 : 500`)
+- Non-generic catch responses (extra fields like `{ error, steps: err.steps || [] }`)
+- 4xx-mapping catches (`err.message.includes('forbidden') ? 403 : 500`)
+- Callback-based async inside a handler (SSE streaming, `docker.loadImage`)
+- Catches that do additional business logic (`log.error(…)` then respond)
+
+10 legitimate `res.status(500)` call sites remain — all inspected and confirmed non-generic.
+
+### Verification
+
+- **Tests:** 740 passing / 4 skipped (identical to v6.14.0 baseline).
+- **Lint:** `eslint src/routes/ --max-warnings 0` clean.
+- Behavior-preserving: clients keep receiving `{ error: "<sanitized message>" }` with 5xx status — the sanitization itself is the only behavior change, and that's an upgrade (not a downgrade) from the previous accidental leak.
+
+### Files touched
+
+- `src/utils/asyncHandler.js` (new)
+- 21 files in `src/routes/` — net −521 LOC
+
+---
+
 ## [6.14.0] - 2026-04-22 — "Express 4 → Express 5"
 
 BACKLOG P2 item closed. Deep-spec ([plans/deep-spec-express5-migration.md](plans/deep-spec-express5-migration.md)) predicted 3-5h based on evidence that the codebase was already v5-idiomatic. Actual execution cost ~2h with one mid-flight snag (see below).

docker-compose.yml

@@ -4,8 +4,8 @@ services:
       context: .
       dockerfile: Dockerfile
       args:
-        APP_VERSION: "${APP_VERSION:-6.14.0}"
-    image: docker-dash:${APP_VERSION:-6.14.0}
+        APP_VERSION: "${APP_VERSION:-6.14.1}"
+    image: docker-dash:${APP_VERSION:-6.14.1}
     container_name: docker-dash
     restart: unless-stopped
     env_file:
@@ -54,7 +54,7 @@ services:
   dd-egress-filter:
     build:
       context: ./docker/egress-filter
-    image: docker-dash-egress-filter:${APP_VERSION:-6.14.0}
+    image: docker-dash-egress-filter:${APP_VERSION:-6.14.1}
     container_name: dd-egress-filter
     restart: unless-stopped
     # Uses the default bridge so target containers on the default bridge can

package.json

@@ -1,6 +1,6 @@
 {
   "name": "docker-dash",
-  "version": "6.14.0",
+  "version": "6.14.1",
   "description": "Full-featured Docker management dashboard",
   "main": "src/server.js",
   "scripts": {

public/js/pages/whatsnew.js

@@ -9,6 +9,17 @@ const WhatsNewPage = {
   // Add new releases at the TOP of this array.
   // Types: feature, fix, improvement, security, breaking
   _releases: [
+    {
+      version: '6.14.1',
+      date: '2026-04-22',
+      title: 'asyncHandler refactor + accidental info-leak fix',
+      changes: [
+        { type: 'security', text: 'Non-obvious security fix discovered during the refactor: Docker Dash\'s central error middleware at src/server.js:168 already sanitizes 5xx responses (scrubs /home/ and /data/ paths, redacts credentials in URLs, replaces raw err.message with "Internal server error"). The 21 route files with try/catch wrappers were BYPASSING this sanitization by calling res.status(500).json({ error: err.message }) directly — leaking raw exception text to clients. All generic 500 handlers now go through the sanitizer.' },
+        { type: 'improvement', text: 'Post-Express-5 cleanup: new src/utils/asyncHandler.js (4 lines) wraps async handlers so rejected promises auto-forward to the error middleware. 175 handler invocations migrated across 21 route files. Net diff: -521 LOC of boilerplate gone.' },
+        { type: 'improvement', text: 'Handlers with dynamic status codes, non-generic catch shapes (extra fields), 4xx-mapping logic, SSE streaming, or business-logic in the catch block were LEFT ALONE intentionally — those aren\'t boilerplate, they\'re intentional error handling. 10 legitimate res.status(500) call sites remain.' },
+        { type: 'improvement', text: 'Tests: 740 passing / 4 skipped (unchanged). Lint: zero warnings on src/routes/.' },
+      ],
+    },
     {
       version: '6.14.0',
       date: '2026-04-22',

src/routes/alerts.js

@@ -5,6 +5,7 @@ const alertService = require('../services/alerts');
 const auditService = require('../services/audit');
 const { requireAuth, requireRole } = require('../middleware/auth');
 const { getClientIp } = require('../utils/helpers');
+const asyncHandler = require('../utils/asyncHandler');
 
 const router = Router();
 
@@ -15,44 +16,36 @@ router.get('/rules/:id', requireAuth, (req, res) => {
   res.json(rule);
 });
 
-router.post('/rules', requireAuth, requireRole('admin', 'operator'), (req, res) => {
-  try {
-    const result = alertService.createRule({ ...req.body, created_by: req.user.id });
-    auditService.log({ userId: req.user.id, username: req.user.username,
-      action: 'alert_rule_create', targetType: 'alert_rule', targetId: String(result.id), ip: getClientIp(req) });
-    res.status(201).json(result);
-  } catch (err) { res.status(500).json({ error: err.message }); }
-});
-
-router.put('/rules/:id', requireAuth, requireRole('admin', 'operator'), (req, res) => {
-  try {
-    alertService.updateRule(parseInt(req.params.id), req.body);
-    auditService.log({ userId: req.user.id, username: req.user.username,
-      action: 'alert_rule_update', targetType: 'alert_rule', targetId: req.params.id, ip: getClientIp(req) });
-    res.json({ ok: true });
-  } catch (err) { res.status(500).json({ error: err.message }); }
-});
-
-router.delete('/rules/:id', requireAuth, requireRole('admin'), (req, res) => {
-  try {
-    alertService.deleteRule(parseInt(req.params.id));
-    auditService.log({ userId: req.user.id, username: req.user.username,
-      action: 'alert_rule_delete', targetType: 'alert_rule', targetId: req.params.id, ip: getClientIp(req) });
-    res.json({ ok: true });
-  } catch (err) { res.status(500).json({ error: err.message }); }
-});
+router.post('/rules', requireAuth, requireRole('admin', 'operator'), asyncHandler((req, res) => {
+  const result = alertService.createRule({ ...req.body, created_by: req.user.id });
+  auditService.log({ userId: req.user.id, username: req.user.username,
+    action: 'alert_rule_create', targetType: 'alert_rule', targetId: String(result.id), ip: getClientIp(req) });
+  res.status(201).json(result);
+}));
+
+router.put('/rules/:id', requireAuth, requireRole('admin', 'operator'), asyncHandler((req, res) => {
+  alertService.updateRule(parseInt(req.params.id), req.body);
+  auditService.log({ userId: req.user.id, username: req.user.username,
+    action: 'alert_rule_update', targetType: 'alert_rule', targetId: req.params.id, ip: getClientIp(req) });
+  res.json({ ok: true });
+}));
+
+router.delete('/rules/:id', requireAuth, requireRole('admin'), asyncHandler((req, res) => {
+  alertService.deleteRule(parseInt(req.params.id));
+  auditService.log({ userId: req.user.id, username: req.user.username,
+    action: 'alert_rule_delete', targetType: 'alert_rule', targetId: req.params.id, ip: getClientIp(req) });
+  res.json({ ok: true });
+}));
 
 router.get('/active', requireAuth, (req, res) => { res.json(alertService.getActiveAlerts()); });
 router.get('/history', requireAuth, (req, res) => {
   const { page, limit } = req.query;
   res.json(alertService.getAlertHistory({ page: parseInt(page) || 1, limit: parseInt(limit) || 50 }));
 });
 
-router.post('/events/:id/acknowledge', requireAuth, (req, res) => {
-  try {
-    alertService.acknowledge(parseInt(req.params.id), req.user.id);
-    res.json({ ok: true });
-  } catch (err) { res.status(500).json({ error: err.message }); }
-});
+router.post('/events/:id/acknowledge', requireAuth, asyncHandler((req, res) => {
+  alertService.acknowledge(parseInt(req.params.id), req.user.id);
+  res.json({ ok: true });
+}));
 
 module.exports = router;

src/routes/audit.js

@@ -3,70 +3,59 @@
 const { Router } = require('express');
 const auditService = require('../services/audit');
 const { requireAuth, requireRole } = require('../middleware/auth');
+const asyncHandler = require('../utils/asyncHandler');
 
 const router = Router();
 
 // Query audit log (admin only)
-router.get('/', requireAuth, requireRole('admin'), (req, res) => {
-  try {
-    const { action, targetType, userId, page, limit, since, until } = req.query;
-    const result = auditService.query({
-      action,
-      targetType,
-      userId: userId ? parseInt(userId) : undefined,
-      page: parseInt(page) || 1,
-      limit: Math.min(parseInt(limit) || 50, 500),
-      since,
-      until,
-    });
-    res.json(result);
-  } catch (err) {
-    res.status(500).json({ error: err.message });
-  }
-});
+router.get('/', requireAuth, requireRole('admin'), asyncHandler((req, res) => {
+  const { action, targetType, userId, page, limit, since, until } = req.query;
+  const result = auditService.query({
+    action,
+    targetType,
+    userId: userId ? parseInt(userId) : undefined,
+    page: parseInt(page) || 1,
+    limit: Math.min(parseInt(limit) || 50, 500),
+    since,
+    until,
+  });
+  res.json(result);
+}));
 
 // Verify audit log integrity (admin only)
-router.get('/verify', requireAuth, requireRole('admin'), (req, res) => {
-  try {
-    const { from, to } = req.query;
-    const result = auditService.verify({
-      fromId: from ? parseInt(from) : undefined,
-      toId: to ? parseInt(to) : undefined,
-    });
-    res.json(result);
-  } catch (err) {
-    res.status(500).json({ error: err.message });
-  }
-});
+router.get('/verify', requireAuth, requireRole('admin'), asyncHandler((req, res) => {
+  const { from, to } = req.query;
+  const result = auditService.verify({
+    fromId: from ? parseInt(from) : undefined,
+    toId: to ? parseInt(to) : undefined,
+  });
+  res.json(result);
+}));
 
 // Export audit log (admin only)
-router.get('/export', requireAuth, requireRole('admin'), (req, res) => {
-  try {
-    const { format, since, until, action, userId } = req.query;
-    const validFormats = ['json', 'csv', 'syslog'];
-    const fmt = validFormats.includes(format) ? format : 'json';
-
-    const data = auditService.export(fmt, {
-      since,
-      until,
-      action,
-      userId: userId ? parseInt(userId) : undefined,
-    });
-
-    const contentTypes = {
-      json: 'application/json',
-      csv: 'text/csv',
-      syslog: 'text/plain',
-    };
-
-    const extensions = { json: 'json', csv: 'csv', syslog: 'log' };
-
-    res.setHeader('Content-Type', contentTypes[fmt]);
-    res.setHeader('Content-Disposition', `attachment; filename="audit-export.${extensions[fmt]}"`);
-    res.send(data);
-  } catch (err) {
-    res.status(500).json({ error: err.message });
-  }
-});
+router.get('/export', requireAuth, requireRole('admin'), asyncHandler((req, res) => {
+  const { format, since, until, action, userId } = req.query;
+  const validFormats = ['json', 'csv', 'syslog'];
+  const fmt = validFormats.includes(format) ? format : 'json';
+
+  const data = auditService.export(fmt, {
+    since,
+    until,
+    action,
+    userId: userId ? parseInt(userId) : undefined,
+  });
+
+  const contentTypes = {
+    json: 'application/json',
+    csv: 'text/csv',
+    syslog: 'text/plain',
+  };
+
+  const extensions = { json: 'json', csv: 'csv', syslog: 'log' };
+
+  res.setHeader('Content-Type', contentTypes[fmt]);
+  res.setHeader('Content-Disposition', `attachment; filename="audit-export.${extensions[fmt]}"`);
+  res.send(data);
+}));
 
 module.exports = router;