bug: 409 handler returns raw PostgreSQL error message (schema disclosure)

[yingliu-data]

Bug Report

The data-integrity (409) exception handler returns the raw PostgreSQL error message to the client, leaking schema internals.

configuration/GlobalExceptionHandler.java:105-112 (handleDataAccessException) — the 409 response body is built from ex.getMostSpecificCause().getMessage(), i.e. the underlying Postgres error text.

Reproduction

Any request that trips a DB constraint (duplicate key, FK/NOT-NULL violation) returns a body leaking table names, column names, constraint names, and SQL detail to the caller.

Severity

Medium

Potential Risk

• Internal schema disclosure that aids attackers in mapping the database; inconsistent with returning safe, generic error messages.

Suggested Fix

• Return a generic client-safe message (e.g. "The request conflicts with existing data") with the appropriate status, and log the detailed cause server-side only.
• Optionally map well-known constraints to friendly messages without echoing raw SQL text.

Broader than #722, which is scoped to mentee-registration 500s.