From e4a912023fb31231b5a434ac237e480021350c80 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Kud=C4=9Blka?= <tomas@appsdevteam.com>
Date: Tue, 28 Apr 2026 07:51:28 +0200
Subject: [PATCH] Sanitize and truncate Guzzle error messages

Prevent binary data and excessively long request/response bodies from being included in exception messages to ensure logs remain readable.
---
 src/Guzzle.php | 32 ++++++++++++++++++++++++++++++--
 1 file changed, 30 insertions(+), 2 deletions(-)

diff --git a/src/Guzzle.php b/src/Guzzle.php
index ada18ab..f9d72c0 100644
--- a/src/Guzzle.php
+++ b/src/Guzzle.php
@@ -10,6 +10,8 @@
 
 class Guzzle
 {
+	private const MAX_BODY_LENGTH = 10000;
+
 	/**
 	 * @throws Throwable
 	 */
@@ -18,13 +20,39 @@ public static function handleException(Throwable $e): ?Exception
 		if ($e instanceof GuzzleException) {
 			$message = '';
 			if ($e instanceof ConnectException || $e instanceof RequestException) {
-				$message = "--- REQUEST ---\n" . Message::toString($e->getRequest()) . "\n --- RESPONSE ---\n";
+				$message = "--- REQUEST ---\n" . self::sanitizeMessage(Message::toString($e->getRequest())) . "\n --- RESPONSE ---\n";
 			}
-			$message .= ($e instanceof RequestException && $e->getResponse() ? Message::toString($e->getResponse()) : $e->getMessage());
+			$message .= ($e instanceof RequestException && $e->getResponse() ? self::sanitizeMessage(Message::toString($e->getResponse())) : $e->getMessage());
 
 			throw new Exception($message);
 		}
 
 		throw $e;
 	}
+
+	private static function sanitizeMessage(string $message): string
+	{
+		// Odstraneni binarnich dat (null byty apod.)
+		if (preg_match('/[^\x20-\x7E\x0A\x0D\t]/u', $message)) {
+			// Najdeme konec hlavicek (prazdny radek)
+			$headerEnd = strpos($message, "\r\n\r\n");
+			if ($headerEnd === false) {
+				$headerEnd = strpos($message, "\n\n");
+			}
+
+			if ($headerEnd !== false) {
+				$headers = substr($message, 0, $headerEnd);
+				return $headers . "\n\n[binary data removed]";
+			}
+
+			return '[binary data removed]';
+		}
+
+		// Oriznuti prilis dlouhych textovych odpovedi
+		if (strlen($message) > self::MAX_BODY_LENGTH) {
+			return substr($message, 0, self::MAX_BODY_LENGTH) . "\n\n... [truncated, total " . strlen($message) . " bytes]";
+		}
+
+		return $message;
+	}
 }