Sanitize full path in error message

kamil-tekiela · kamil-tekiela · commit f8b532302bb2 · 2025-11-16T00:10:43.000Z
Signed-off-by: Kamil Tekiela &lt;tekiela246@gmail.com&gt;
diff --git a/src/Error/ErrorHandler.php b/src/Error/ErrorHandler.php
@@ -24,7 +24,10 @@
 use function function_exists;
 use function htmlspecialchars;
 use function sprintf;
+use function str_contains;
+use function str_replace;
 
+use const DIRECTORY_SEPARATOR;
 use const E_COMPILE_ERROR;
 use const E_COMPILE_WARNING;
 use const E_CORE_ERROR;
@@ -224,10 +227,8 @@ public function handleError(
      */
     public function handleException(Throwable $exception): void
     {
-        $message = $exception::class . ': ' . $exception->getMessage();
-
         $this->addError(
-            $message,
+            $exception::class . ': ' . $exception->getMessage(),
             (int) $exception->getCode(),
             $exception->getFile(),
             $exception->getLine(),
@@ -258,6 +259,10 @@ public function addError(
         int $errline,
         bool $escape = true,
     ): void {
+        if (str_contains($errstr, ROOT_PATH)) {
+            $errstr = str_replace(ROOT_PATH, '.' . DIRECTORY_SEPARATOR, $errstr);
+        }
+
         if ($escape) {
             $errstr = htmlspecialchars($errstr);
         }
