Conversation
jp-tosca
added
GREI Re-arch
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| return ok(execCommand(setDriverCommand)); | ||
|
|
||
| } catch (IllegalArgumentException iae) { | ||
| return error(Response.Status.NOT_FOUND, iae.getMessage()); |
Check warning
Code scanning / CodeQL
Information exposure through an error message Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 12 hours ago
In general, to fix this kind of flaw, do not propagate raw exception messages (via getMessage() or stack traces) back to clients. Instead, log the exception details on the server (including message and stack trace) and return a generic, non-sensitive error message to the user. This preserves diagnosability for developers while reducing information leakage.
For this specific case in src/main/java/edu/harvard/iq/dataverse/api/Dataverses.java at line 2092, we should replace error(Response.Status.NOT_FOUND, iae.getMessage()) with a call that: (1) logs the exception using the existing Logger declared in this class (commonly private static final Logger logger = Logger.getLogger(Dataverses.class.getName()); in Dataverse APIs), and (2) returns a generic message such as "Could not set storage driver for this dataverse." or a similarly vague description. We will add a log statement right before returning the error, e.g. logger.log(Level.WARNING, "Failed to set storage driver for dataverse " + id, iae);, and change the response body to that generic message. No new imports are required because java.util.logging.Logger and java.util.logging.Level are already imported at the top of the file.
| @@ -2089,7 +2089,8 @@ | ||
| return ok(execCommand(setDriverCommand)); | ||
|
|
||
| } catch (IllegalArgumentException iae) { | ||
| return error(Response.Status.NOT_FOUND, iae.getMessage()); | ||
| logger.log(Level.WARNING, "Failed to set storage driver for dataverse " + id, iae); | ||
| return error(Response.Status.NOT_FOUND, "Could not set storage driver for this dataverse."); | ||
| } | ||
|
|
||
| } |
| DeleteDataverseStorageDriverComman deleteDriverCommand = new DeleteDataverseStorageDriverComman(request, dataverse); | ||
| return ok(execCommand(deleteDriverCommand)); | ||
| } catch (Exception e) { | ||
| return error(Response.Status.NOT_FOUND, e.getMessage()); |
Check warning
Code scanning / CodeQL
Information exposure through an error message Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 12 hours ago
To fix the problem, the API should stop returning raw exception messages from server-side exceptions to the client. Instead, it should log the full exception server-side (including the stack trace) and return a generic, non-revealing message to the client. This preserves debuggability for developers while avoiding information leakage.
In this file, the problematic instance is in resetStorageDriver at line 2113: return error(Response.Status.NOT_FOUND, e.getMessage());. The best fix is to (1) log the exception using the existing Logger facility in this class, and (2) replace e.getMessage() with a generic message such as “Failed to reset storage driver.” that does not contain internal details. We should also avoid changing the status code or other behavior to keep existing functionality as intact as possible (clients will still get a 404 error, only with a sanitized message).
Concretely:
- In
src/main/java/edu/harvard/iq/dataverse/api/Dataverses.java, insideresetStorageDriver, update thecatch (Exception e)block to:- Log the exception using the existing
private static final Logger logger = Logger.getLogger(Dataverses.class.getCanonicalName());field (which is already present in this class elsewhere, given thejava.util.logging.Loggerimport). - Return
error(Response.Status.NOT_FOUND, "Failed to reset storage driver.");(or similar neutral text), instead of usinge.getMessage().
- Log the exception using the existing
No new imports or helper methods are required; we can use the existing logger and Level from java.util.logging.
| @@ -2110,7 +2110,9 @@ | ||
| DeleteDataverseStorageDriverComman deleteDriverCommand = new DeleteDataverseStorageDriverComman(request, dataverse); | ||
| return ok(execCommand(deleteDriverCommand)); | ||
| } catch (Exception e) { | ||
| return error(Response.Status.NOT_FOUND, e.getMessage()); | ||
| logger.log(Level.WARNING, "Failed to reset storage driver for dataverse with identifier ''{0}''.", new Object[] { id }); | ||
| logger.log(Level.FINE, "Exception while resetting storage driver", e); | ||
| return error(Response.Status.NOT_FOUND, "Failed to reset storage driver."); | ||
| } | ||
| } | ||
|
|
| GetDataverseAllowedStorageDriverCommand getAllowedStorageDriversCommand = new GetDataverseAllowedStorageDriverCommand(request, dv); | ||
| return ok(execCommand(getAllowedStorageDriversCommand)); | ||
| } catch (Exception e) { | ||
| return error(Response.Status.INTERNAL_SERVER_ERROR, e.getMessage()); |
Check warning
Code scanning / CodeQL
Information exposure through an error message Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 12 hours ago
In general, the fix is to avoid returning raw exception messages to the client and instead send a generic, non-revealing error message, while logging the detailed exception server-side for diagnostics. This preserves functionality (the endpoint still indicates failure) without exposing internal details.
For this specific endpoint (listStorageDrivers in Dataverses.java), we should change the catch (Exception e) block to:
- Log the exception using the existing Java logging facility (
Logger) and the class’s logger name. - Return a generic error response instead of
e.getMessage(). A message like"An internal error occurred while listing storage drivers."is appropriate.
We only touch the shown snippet, around lines 2131–2138. No new dependencies are needed; the file already importsjava.util.logging.Loggerandjava.util.logging.Level, so we can useLogger.getLogger(Dataverses.class.getName()).log(Level.SEVERE, "...", e);in the catch block.
| @@ -2134,7 +2134,8 @@ | ||
| GetDataverseAllowedStorageDriverCommand getAllowedStorageDriversCommand = new GetDataverseAllowedStorageDriverCommand(request, dv); | ||
| return ok(execCommand(getAllowedStorageDriversCommand)); | ||
| } catch (Exception e) { | ||
| return error(Response.Status.INTERNAL_SERVER_ERROR, e.getMessage()); | ||
| Logger.getLogger(Dataverses.class.getName()).log(Level.SEVERE, "Error listing storage drivers for dataverse " + id, e); | ||
| return error(Response.Status.INTERNAL_SERVER_ERROR, "An internal error occurred while listing storage drivers."); | ||
| } | ||
| } | ||
|
|
|
📦 Pushed preview images as 🚢 See on GHCR. Use by referencing with full name as printed above, mind the registry name. |
2 participants
What this PR does / why we need it:
Which issue(s) this PR closes:
Special notes for your reviewer:
Suggestions on how to test this:
Does this PR introduce a user interface change? If mockups are available, please link/include them here:
Is there a release notes update needed for this change?:
Additional documentation: