From 4e5e142cd08e99e56d0bcb5d71767079d5c6288c Mon Sep 17 00:00:00 2001
From: Inverle <inverle@proton.me>
Date: Sat, 3 Oct 2026 23:28:39 +0200
Subject: [PATCH] Remove vulnerable and unused code path for displaying errors
 (#9395)

If we were to remove or rename `errorController`, an HTML injection could potentially be introduced due to the fallback code path, that directly echoes the logs without any escaping.

(but mainly removing it to reduce the amount of code, and since it's unused)
---
 lib/Minz/Error.php | 25 +++++--------------------
 1 file changed, 5 insertions(+), 20 deletions(-)

diff --git a/lib/Minz/Error.php b/lib/Minz/Error.php
index eec64ddb6..526836718 100644
--- a/lib/Minz/Error.php
+++ b/lib/Minz/Error.php
@@ -23,28 +23,13 @@ class Minz_Error {
 	*/
 	public static function error(int $code = 404, string|array $logs = [], bool $redirect = true): void {
 		$logs = self::processLogs($logs);
-		$error_filename = APP_PATH . '/Controllers/errorController.php';
 
-		if (file_exists($error_filename)) {
-			Minz_Session::_params([
-				'error_code' => $code,
-				'error_logs' => $logs,
-			]);
+		Minz_Session::_params([
+			'error_code' => $code,
+			'error_logs' => $logs,
+		]);
 
-			Minz_Request::forward(['c' => 'error'], $redirect);
-		} else {
-			echo '<h1>An error occurred</h1>' . "\n";
-
-			if (!empty($logs)) {
-				echo '<ul>' . "\n";
-				foreach ($logs as $log) {
-					echo '<li>' . $log . '</li>' . "\n";
-				}
-				echo '</ul>' . "\n";
-			}
-
-			exit();
-		}
+		Minz_Request::forward(['c' => 'error'], $redirect);
 	}
 
 	/**